review(docs): #1735 patch API spec lines describing awareness_namespace

#1737 deletes the awareness_namespace column from `workspaces` and the provisioner env injection that backed it. Two API-spec lines still describe the field as if it were live, which would mislead any external integrator reading the docs against a post-#1737 backend: - docs/api-reference.md:106 listed `awareness_namespace` as a column on the `workspaces` row. - docs/api-protocol/platform-api.md:93 claimed workspace creation "assigns an awareness_namespace on the workspace row" and the namespace is "later injected into the provisioned runtime". Both are factually wrong post-#1737. Patched. The broader docs sweep (~30 more references across `docs/architecture/memory.md`, `docs/agent-runtime/*`, READMEs, superpowers plans, etc.) is tracked in #1753 as a docs-only follow-up — those are narrative / handbook copy, not contract. Refs: #1735 (RFC), #1737 (the backend removal PR this rebases on), #1753 (docs sweep follow-up), review-finding C3 (API doc contradiction). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
chore(workspace-server): #1735 remove unused Awareness namespace surface
2026-05-23 16:57:14 -07:00 · 2026-05-23 16:55:10 -07:00
396 changed files with 6070 additions and 13166 deletions
@@ -50,6 +50,9 @@ MOLECULE_ENV=development                       # Environment label (development/
 # Container/runtime detection
 # MOLECULE_IN_DOCKER=                    # Set when running the platform inside Docker (accepts 1/0, true/false). Triggers A2A proxy to rewrite 127.0.0.1:<port> agent URLs to Docker bridge hostnames. Auto-detected via /.dockerenv; only set if detection fails or to force off.

+# Observability (Awareness)
+# AWARENESS_URL=                         # If set, injected into workspace containers along with a deterministic AWARENESS_NAMESPACE derived from workspace ID. Enables the cross-session memory MCP server.
+
 # GitHub
 # GITHUB_REPO=owner/repo                 # Target repo for agent initial_prompt clone (e.g. Molecule-AI/molecule-monorepo). Read inside workspace containers.
 # GITHUB_TOKEN=                          # Personal access token / installation token used by agents that clone private repos. Register as a global secret via POST /admin/secrets for propagation to workspace env. Token is used in-URL during clone and then scrubbed from .git/config via `git remote set-url`.
@@ -21,11 +21,14 @@ from urllib.parse import quote
 TRUE_VALUES = {"1", "true", "yes", "on", "disabled", "disable"}
 PROD_CP_URL = "https://api.moleculesai.app"
 DEFAULT_REQUIRED_CONTEXTS = [
+    "CI / Platform (Go) (push)",
+    "CI / Canvas (Next.js) (push)",
+    "CI / Shellcheck (E2E scripts) (push)",
+    "CI / Python Lint & Test (push)",
    "CI / all-required (push)",
    "Secret scan / Scan diff for credential-shaped strings (push)",
 ]
 TERMINAL_FAILURE_STATES = {"failure", "error", "cancelled", "canceled", "skipped"}
-REDEPLOY_PATH = "/cp/admin/tenants/redeploy-fleet"


 def truthy_flag(value: str | None) -> bool:
@@ -131,154 +134,6 @@ def required_contexts(env: dict[str, str]) -> list[str]:
    return [line.strip() for line in raw.replace(",", "\n").splitlines() if line.strip()]


-def chunks(items: list[str], size: int) -> list[list[str]]:
-    return [items[i : i + size] for i in range(0, len(items), size)]
-
-
-class RolloutFailed(RuntimeError):
-    def __init__(self, message: str, response: dict):
-        super().__init__(message)
-        self.response = response
-
-
-def slugs_from_redeploy_response(body: dict) -> list[str]:
-    slugs: list[str] = []
-    for row in body.get("results") or []:
-        slug = str(row.get("slug") or "").strip()
-        if slug:
-            slugs.append(slug)
-    return slugs
-
-
-def scoped_redeploy_body(base: dict, slugs: list[str]) -> dict:
-    body = dict(base)
-    body.pop("canary_slug", None)
-    body["only_slugs"] = slugs
-    body["soak_seconds"] = 0
-    body["batch_size"] = max(1, len(slugs))
-    return body
-
-
-def cp_api_json(method: str, url: str, token: str, body: dict | None = None) -> tuple[int, dict]:
-    data = None
-    headers = {
-        "Authorization": f"Bearer {token}",
-        "Accept": "application/json",
-    }
-    if body is not None:
-        data = json.dumps(body).encode("utf-8")
-        headers["Content-Type"] = "application/json"
-    req = urllib.request.Request(url, data=data, headers=headers, method=method)
-    try:
-        with urllib.request.urlopen(req, timeout=120) as resp:
-            return resp.status, json.loads(resp.read())
-    except urllib.error.HTTPError as exc:
-        raw = exc.read().decode("utf-8", errors="replace")
-        try:
-            parsed = json.loads(raw)
-        except json.JSONDecodeError:
-            parsed = {"error": raw[:500]}
-        return exc.code, parsed
-
-
-def plan_rollout_slugs(cp_url: str, token: str, body: dict, redeploy=None) -> list[str]:
-    if redeploy is None:
-        redeploy = redeploy_scoped
-    dry_run_body = dict(body)
-    dry_run_body["dry_run"] = True
-    status, resp = redeploy(cp_url, token, dry_run_body)
-    if status != 200:
-        raise RuntimeError(f"dry-run redeploy-fleet returned HTTP {status}: {resp.get('error', '')}")
-    if resp.get("ok") is not True:
-        raise RuntimeError(f"dry-run redeploy-fleet reported ok={resp.get('ok')}: {resp.get('error', '')}")
-    slugs = slugs_from_redeploy_response(resp)
-    if not slugs:
-        raise RuntimeError("dry-run redeploy-fleet returned no rollout candidates")
-    return slugs
-
-
-def redeploy_scoped(cp_url: str, token: str, body: dict) -> tuple[int, dict]:
-    return cp_api_json("POST", f"{cp_url}{REDEPLOY_PATH}", token, body)
-
-
-def _raise_for_redeploy_result(status: int, body: dict, slugs: list[str]) -> None:
-    if status != 200 or body.get("ok") is not True:
-        raise RuntimeError(
-            "redeploy scoped call failed for "
-            f"{','.join(slugs)}: HTTP {status}, ok={body.get('ok')}"
-        )
-
-
-def execute_scoped_rollout(
-    plan: dict,
-    token: str,
-    list_slugs=plan_rollout_slugs,
-    redeploy=redeploy_scoped,
-    sleep=time.sleep,
-) -> dict:
-    cp_url = plan["cp_url"]
-    base_body = plan["body"]
-    all_slugs = list_slugs(cp_url, token, base_body)
-    batch_size = int(base_body.get("batch_size") or 1)
-    canary_slug = str(base_body.get("canary_slug") or "").strip()
-    dry_run = bool(base_body.get("dry_run"))
-    aggregate = {"ok": True, "results": []}
-
-    if canary_slug:
-        if canary_slug not in all_slugs:
-            raise RuntimeError(f"configured canary slug {canary_slug!r} is not a running tenant")
-        body = scoped_redeploy_body(base_body, [canary_slug])
-        print(f"POST {cp_url}{REDEPLOY_PATH} only_slugs={','.join(body['only_slugs'])}")
-        status, resp = redeploy(cp_url, token, body)
-        aggregate["results"].extend(resp.get("results") or [])
-        try:
-            _raise_for_redeploy_result(status, resp, [canary_slug])
-        except RuntimeError as exc:
-            aggregate["ok"] = False
-            aggregate["error"] = str(exc)
-            raise RolloutFailed(str(exc), aggregate) from exc
-        soak_seconds = int(base_body.get("soak_seconds") or 0)
-        if soak_seconds > 0 and not dry_run:
-            print(f"Canary passed; soaking locally for {soak_seconds}s")
-            sleep(soak_seconds)
-
-    remaining = [slug for slug in all_slugs if slug != canary_slug]
-    for group in chunks(remaining, batch_size):
-        body = scoped_redeploy_body(base_body, group)
-        print(f"POST {cp_url}{REDEPLOY_PATH} only_slugs={','.join(group)}")
-        status, resp = redeploy(cp_url, token, body)
-        aggregate["results"].extend(resp.get("results") or [])
-        try:
-            _raise_for_redeploy_result(status, resp, group)
-        except RuntimeError as exc:
-            aggregate["ok"] = False
-            aggregate["error"] = str(exc)
-            raise RolloutFailed(str(exc), aggregate) from exc
-
-    return aggregate
-
-
-def rollout_from_plan_file(plan_path: str, response_path: str, env: dict[str, str]) -> None:
-    token = env.get("CP_ADMIN_API_TOKEN", "").strip()
-    if not token:
-        raise ValueError("CP_ADMIN_API_TOKEN is required for production auto-deploy")
-    with open(plan_path, "r", encoding="utf-8") as fh:
-        plan = json.load(fh)
-    if not plan.get("enabled"):
-        raise RuntimeError("production auto-deploy plan is disabled")
-    try:
-        response = execute_scoped_rollout(plan, token)
-    except RolloutFailed as exc:
-        response = exc.response
-        with open(response_path, "w", encoding="utf-8") as fh:
-            json.dump(response, fh, sort_keys=True)
-            fh.write("\n")
-        raise
-    with open(response_path, "w", encoding="utf-8") as fh:
-        json.dump(response, fh, sort_keys=True)
-        fh.write("\n")
-
-
 def _api_json(url: str, token: str) -> dict:
    req = urllib.request.Request(url, headers={"Authorization": f"token {token}"})
    try:
@@ -380,9 +235,6 @@ def main() -> int:
    sub.add_parser("plan", help="print production deploy plan as JSON")
    sub.add_parser("assert-enabled", help="fail if production deploy is currently disabled")
    sub.add_parser("wait-ci", help="block until required CI context is green")
-    rollout_parser = sub.add_parser("rollout", help="execute canary-first scoped production rollout")
-    rollout_parser.add_argument("--plan", required=True, help="path to prod-auto-deploy plan JSON")
-    rollout_parser.add_argument("--response", required=True, help="path to write aggregate response JSON")
    args = parser.parse_args()

    try:
@@ -395,9 +247,6 @@ def main() -> int:
        if args.command == "wait-ci":
            wait_for_ci_context(dict(os.environ))
            return 0
-        if args.command == "rollout":
-            rollout_from_plan_file(args.plan, args.response, dict(os.environ))
-            return 0
    except Exception as exc:  # noqa: BLE001 - CLI should render operator-friendly errors.
        print(f"::error::{exc}", file=sys.stderr)
        return 1
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-# shellcheck disable=SC2016,SC2329
 # review-check — evaluate whether a PR satisfies a single team-review gate.
 #
 # RFC#324 Step 1 of 5 — qa-review + security-review check workflows.
@@ -209,10 +208,10 @@ fi
 JQ_FILTER="${JQ_FILTER}
  | .user.login"

-REVIEW_CANDIDATES=$(jq -r --arg author "$PR_AUTHOR" --arg head "$PR_HEAD_SHA" "$JQ_FILTER" "$REVIEWS_JSON" | sort -u)
-debug "candidate non-author approvers: $(echo "$REVIEW_CANDIDATES" | tr '\n' ' ')"
+CANDIDATES=$(jq -r --arg author "$PR_AUTHOR" --arg head "$PR_HEAD_SHA" "$JQ_FILTER" "$REVIEWS_JSON" | sort -u)
+debug "candidate non-author approvers: $(echo "$CANDIDATES" | tr '\n' ' ')"

-if [ -z "$REVIEW_CANDIDATES" ]; then
+if [ -z "$CANDIDATES" ]; then
  # --- Guardrail (internal#503): explain the most common false
  # "no candidates" red. Gitea's review event enum is EXACTLY
  # APPROVED/REQUEST_CHANGES/COMMENT/PENDING. A wrong value ("APPROVE",
@@ -237,52 +236,55 @@ if [ -z "$REVIEW_CANDIDATES" ]; then
    done
  fi

-fi
+  # --- Fallback (internal#348): check issue comments for agent-approval ---
+  # core-qa-agent and core-security-agent approve via issue comments, NOT
+  # the reviews API. The reviews API returns zero entries for comment-only
+  # approvals. This fallback reads PR issue comments and extracts logins that:
+  #   1. Posted a comment matching the agent-prefix pattern for this gate:
+  #        qa      → "[core-qa-agent] APPROVED"
+  #        security → "[core-security-agent] APPROVED"
+  #      OR posted a generic approval keyword (word-anchored, case-insensitive):
+  #        APPROVED / LGTM / ACCEPTED
+  #   2. Are not the PR author
+  #   3. The team-membership probe below is the authoritative filter.
+  AGENT_PATTERN=""
+  case "$TEAM" in
+    qa)       AGENT_PATTERN="\\[core-qa-agent\\]" ;;
+    security) AGENT_PATTERN="\\[core-security-agent\\]" ;;
+  esac
+  HTTP_CODE=$(curl -sS -o "$COMMENTS_JSON" -w '%{http_code}' \
+    -K "$CURL_AUTH_FILE" "${API}/repos/${OWNER}/${NAME}/issues/${PR_NUMBER}/comments")
+  debug "GET /issues/${PR_NUMBER}/comments → HTTP ${HTTP_CODE}"
+  if [ "$HTTP_CODE" = "200" ]; then
+    # JQ expression: select non-author comments that match either the
+    # agent-prefix pattern (case-insensitive) OR a generic approval keyword.
+    JQ_APPROVALS='
+      .[] |
+      select(.user.login != $author) |
+      . as $cmt |
+      if ($agent_pattern | length) > 0 and ($cmt.body // "" | test($agent_pattern; "i")) then
+        $cmt.user.login
+      elif ($cmt.body // "" | test("\\b(APPROVED|LGTM|ACCEPTED)\\b"; "i")) then
+        $cmt.user.login
+      else
+        empty
+      end
+    '
+    CANDIDATES=$(jq -r \
+      --arg author "$PR_AUTHOR" \
+      --arg agent_pattern "$AGENT_PATTERN" \
+      "$JQ_APPROVALS" \
+      "$COMMENTS_JSON" 2>/dev/null | sort -u)
+    debug "comment-based approval candidates: $(echo "$CANDIDATES" | tr '\n' ' ')"

-# --- Fallback/extension (internal#348): check issue comments for agent-approval ---
-# core-qa-agent and core-security-agent can approve via issue comments. Always
-# include comment candidates, even if the reviews API returned approvals for a
-# different team; team membership below is the authoritative filter.
-COMMENT_CANDIDATES=""
-AGENT_PATTERN=""
-case "$TEAM" in
-  qa)       AGENT_PATTERN="\\[core-qa-agent\\]" ;;
-  security) AGENT_PATTERN="\\[core-security-agent\\]" ;;
-esac
-HTTP_CODE=$(curl -sS -o "$COMMENTS_JSON" -w '%{http_code}' \
-  -K "$CURL_AUTH_FILE" "${API}/repos/${OWNER}/${NAME}/issues/${PR_NUMBER}/comments")
-debug "GET /issues/${PR_NUMBER}/comments → HTTP ${HTTP_CODE}"
-if [ "$HTTP_CODE" = "200" ]; then
-  # JQ expression: select non-author comments that match either the
-  # agent-prefix pattern (case-insensitive) OR a generic approval keyword.
-  JQ_APPROVALS='
-    .[] |
-    select(.user.login != $author) |
-    . as $cmt |
-    if ($agent_pattern | length) > 0 and ($cmt.body // "" | test($agent_pattern; "i")) then
-      $cmt.user.login
-    elif ($cmt.body // "" | test("\\b(APPROVED|LGTM|ACCEPTED)\\b"; "i")) then
-      $cmt.user.login
-    else
-      empty
-    end
-  '
-  COMMENT_CANDIDATES=$(jq -r \
-    --arg author "$PR_AUTHOR" \
-    --arg agent_pattern "$AGENT_PATTERN" \
-    "$JQ_APPROVALS" \
-    "$COMMENTS_JSON" 2>/dev/null | sort -u)
-  debug "comment-based approval candidates: $(echo "$COMMENT_CANDIDATES" | tr '\n' ' ')"
-
-  if [ -n "$COMMENT_CANDIDATES" ]; then
-    echo "::notice::${TEAM}-review: found $(echo "$COMMENT_CANDIDATES" | wc -w | xargs) comment-based approval candidate(s) — verifying team membership..."
+    if [ -n "$CANDIDATES" ]; then
+      echo "::notice::${TEAM}-review: reviews API found no APPROVED reviews; found $(echo "$CANDIDATES" | wc -w | xargs) comment-based approval candidate(s) — verifying team membership..."
+    fi
+  else
+    debug "could not fetch issue comments (HTTP ${HTTP_CODE})"
  fi
-else
-  debug "could not fetch issue comments (HTTP ${HTTP_CODE})"
 fi

-CANDIDATES=$(printf '%s\n%s\n' "$REVIEW_CANDIDATES" "$COMMENT_CANDIDATES" | sed '/^$/d' | sort -u)
-
 if [ -z "${CANDIDATES:-}" ]; then
  echo "::error::${TEAM}-review awaiting non-author APPROVE from ${TEAM} team (no candidates from reviews API or issue comments)"
  exit 1
@@ -20,7 +20,6 @@ Scenarios:
  T15_comments_agent_approval — reviews empty; comments have "[core-qa-agent] APPROVED" → exit 0
  T16_comments_generic_approval — reviews empty; comments have "APPROVED" by team member → exit 0
  T17_comments_no_approval   — reviews empty; comments have no approval keywords → exit 1
-  T18_review_wrong_team_comment_right_team — review candidate 404s, comment candidate passes

 Usage:
  FIXTURE_STATE_DIR=/tmp/x python3 _review_check_fixture.py 8080
@@ -141,10 +140,6 @@ class Handler(http.server.BaseHTTPRequestHandler):
                    {"user": {"login": "alice"}, "body": "I authored this PR", "id": 1},
                    {"user": {"login": "random-user"}, "body": "Looks okay to me", "id": 2},
                ])
-            if sc == "T18_review_wrong_team_comment_right_team":
-                return self._json(200, [
-                    {"user": {"login": "core-qa-agent"}, "body": "[core-qa-agent] APPROVED after focused review", "id": 1},
-                ])
            # Default scenarios (T1–T9, T14): no comments
            return self._json(200, [])

@@ -156,8 +151,6 @@ class Handler(http.server.BaseHTTPRequestHandler):
                return self._empty(404)
            if sc == "T9_team_403":
                return self._empty(403)
-            if sc == "T18_review_wrong_team_comment_right_team" and login == "core-devops":
-                return self._empty(404)
            # T7_team_member: member
            return self._empty(204)

@@ -1,31 +0,0 @@
-from pathlib import Path
-
-import yaml
-
-
-ROOT = Path(__file__).resolve().parents[2]
-
-
-def load_workflow(name: str) -> dict:
-    with (ROOT / "workflows" / name).open() as f:
-        return yaml.safe_load(f)
-
-
-def test_all_required_uses_dedicated_meta_runner_lane():
-    workflow = load_workflow("ci.yml")
-    all_required = workflow["jobs"]["all-required"]
-
-    assert all_required["runs-on"] == "ci-meta"
-    assert "needs" not in all_required
-
-
-def test_all_required_reuses_path_filter_before_polling():
-    workflow = load_workflow("ci.yml")
-    all_required = workflow["jobs"]["all-required"]
-    rendered = str(all_required)
-
-    assert "--profile ci" in rendered
-    assert ".gitea/scripts/detect-changes.py" in rendered
-    assert "REQUIRE_PLATFORM" in rendered
-    assert "REQUIRE_CANVAS" in rendered
-    assert "REQUIRE_SCRIPTS" in rendered
@@ -146,212 +146,3 @@ def test_context_is_terminal_failure_rejects_cancelled_and_skipped():
        assert prod.context_is_terminal_failure(state) is True
    for state in ("pending", "missing", "success"):
        assert prod.context_is_terminal_failure(state) is False
-
-
-def test_default_required_contexts_delegate_path_gating_to_all_required():
-    assert prod.required_contexts({}) == [
-        "CI / all-required (push)",
-        "Secret scan / Scan diff for credential-shaped strings (push)",
-    ]
-
-
-def test_slugs_from_redeploy_response_uses_controlplane_plan_rows():
-    body = {
-        "results": [
-            {"slug": "hongming", "phase": "canary", "ssm_status": "DryRun"},
-            {"slug": "tenant-a", "phase": "batch-1", "ssm_status": "DryRun"},
-            {"slug": "", "phase": "batch-1", "ssm_status": "DryRun"},
-            {"phase": "batch-1", "ssm_status": "DryRun"},
-        ]
-    }
-
-    assert prod.slugs_from_redeploy_response(body) == ["hongming", "tenant-a"]
-
-
-def test_plan_rollout_slugs_asks_controlplane_for_dry_run_plan():
-    calls = []
-
-    def fake_redeploy(_cp_url, _token, body):
-        calls.append(body)
-        return 200, {
-            "ok": True,
-            "results": [
-                {"slug": "hongming", "phase": "canary", "ssm_status": "DryRun"},
-                {"slug": "tenant-a", "phase": "batch-1", "ssm_status": "DryRun"},
-            ],
-        }
-
-    slugs = prod.plan_rollout_slugs(
-        "https://api.moleculesai.app",
-        "secret",
-        {
-            "target_tag": "staging-abcdef1",
-            "canary_slug": "hongming",
-            "soak_seconds": 60,
-            "batch_size": 3,
-            "dry_run": False,
-            "confirm": True,
-        },
-        redeploy=fake_redeploy,
-    )
-
-    assert slugs == ["hongming", "tenant-a"]
-    assert calls == [
-        {
-            "target_tag": "staging-abcdef1",
-            "canary_slug": "hongming",
-            "soak_seconds": 60,
-            "batch_size": 3,
-            "dry_run": True,
-            "confirm": True,
-        }
-    ]
-
-
-def test_scoped_redeploy_body_removes_canary_and_local_soak():
-    base = {
-        "target_tag": "staging-abcdef1",
-        "canary_slug": "hongming",
-        "soak_seconds": 60,
-        "batch_size": 3,
-        "dry_run": False,
-        "confirm": True,
-    }
-
-    scoped = prod.scoped_redeploy_body(base, ["tenant-a", "tenant-b"])
-
-    assert scoped == {
-        "target_tag": "staging-abcdef1",
-        "soak_seconds": 0,
-        "batch_size": 2,
-        "dry_run": False,
-        "confirm": True,
-        "only_slugs": ["tenant-a", "tenant-b"],
-    }
-
-
-def test_plan_scoped_rollout_preserves_canary_then_batches():
-    calls, sleeps = [], []
-
-    def fake_list(_cp_url, _token, _body):
-        return ["tenant-a", "hongming", "tenant-b", "tenant-c"]
-
-    def fake_redeploy(_cp_url, _token, body):
-        calls.append(body)
-        return 200, {
-            "ok": True,
-            "results": [{"slug": slug, "healthz_ok": True} for slug in body["only_slugs"]],
-        }
-
-    aggregate = prod.execute_scoped_rollout(
-        {
-            "cp_url": "https://api.moleculesai.app",
-            "body": {
-                "target_tag": "staging-abcdef1",
-                "canary_slug": "hongming",
-                "soak_seconds": 60,
-                "batch_size": 2,
-                "dry_run": False,
-                "confirm": True,
-            },
-        },
-        token="secret",
-        list_slugs=fake_list,
-        redeploy=fake_redeploy,
-        sleep=sleeps.append,
-    )
-
-    assert [call["only_slugs"] for call in calls] == [
-        ["hongming"],
-        ["tenant-a", "tenant-b"],
-        ["tenant-c"],
-    ]
-    assert sleeps == [60]
-    assert aggregate["ok"] is True
-    assert [result["slug"] for result in aggregate["results"]] == [
-        "hongming",
-        "tenant-a",
-        "tenant-b",
-        "tenant-c",
-    ]
-
-
-def test_scoped_rollout_halts_after_failed_canary():
-    calls = []
-
-    def fake_redeploy(_cp_url, _token, body):
-        calls.append(body)
-        return 200, {"ok": False, "results": [{"slug": body["only_slugs"][0], "error": "bad"}]}
-
-    try:
-        prod.execute_scoped_rollout(
-            {
-                "cp_url": "https://api.moleculesai.app",
-                "body": {
-                    "target_tag": "staging-abcdef1",
-                    "canary_slug": "hongming",
-                    "soak_seconds": 60,
-                    "batch_size": 2,
-                    "dry_run": False,
-                    "confirm": True,
-                },
-            },
-            token="secret",
-            list_slugs=lambda _cp_url, _token, _body: ["hongming", "tenant-a"],
-            redeploy=fake_redeploy,
-            sleep=lambda _seconds: None,
-        )
-    except prod.RolloutFailed as exc:
-        assert "redeploy scoped call failed" in str(exc)
-        assert exc.response["ok"] is False
-        assert exc.response["results"] == [{"slug": "hongming", "error": "bad"}]
-    else:
-        raise AssertionError("expected failed canary to halt rollout")
-
-    assert [call["only_slugs"] for call in calls] == [["hongming"]]
-
-
-def test_rollout_from_plan_file_writes_partial_response_on_failure(tmp_path):
-    plan_path = tmp_path / "plan.json"
-    response_path = tmp_path / "response.json"
-    plan_path.write_text(
-        """
-        {
-          "enabled": true,
-          "cp_url": "https://api.moleculesai.app",
-          "body": {"target_tag": "staging-abcdef1", "confirm": true}
-        }
-        """,
-        encoding="utf-8",
-    )
-
-    original = prod.execute_scoped_rollout
-
-    def fake_execute(_plan, _token):
-        raise prod.RolloutFailed(
-            "redeploy scoped call failed for hongming: HTTP 500, ok=false",
-            {
-                "ok": False,
-                "error": "redeploy scoped call failed for hongming: HTTP 500, ok=false",
-                "results": [{"slug": "hongming", "error": "bad"}],
-            },
-        )
-
-    prod.execute_scoped_rollout = fake_execute
-    try:
-        try:
-            prod.rollout_from_plan_file(
-                str(plan_path),
-                str(response_path),
-                {"CP_ADMIN_API_TOKEN": "secret"},
-            )
-        except prod.RolloutFailed:
-            pass
-        else:
-            raise AssertionError("expected rollout failure")
-    finally:
-        prod.execute_scoped_rollout = original
-
-    assert response_path.read_text(encoding="utf-8").strip()
-    assert '"ok": false' in response_path.read_text(encoding="utf-8")
-    assert '"slug": "hongming"' in response_path.read_text(encoding="utf-8")
@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-# shellcheck disable=SC2034
 # Regression tests for .gitea/scripts/review-check.sh (RFC#324 Step 1).
 #
 # Covers:
@@ -17,7 +16,6 @@
 #   T12 — jq filter: non-author APPROVED → in candidate list; dismissed → excluded
 #   T13 — missing required env GITEA_TOKEN → exits 1 with error
 #   T14 — non-default-base PR exits 0 without requiring review
-#   T18 — wrong-team review candidate does not block right-team comment approval
 #
 # Hostile-self-review (per feedback_assert_exact_not_substring):
 # this test MUST FAIL if the script is absent. Verified by running
@@ -140,7 +138,7 @@ fi
 echo
 echo "== T13 missing GITEA_TOKEN =="
 set +e
-T13_OUT=$(PATH="/tmp:$PATH" GITEA_TOKEN='' GITEA_HOST=git.example.com REPO=x/y PR_NUMBER=1 TEAM=qa TEAM_ID=1 bash "$SCRIPT" 2>&1 || true)
+T13_OUT=$(PATH="/tmp:$PATH" GITEA_TOKEN= GITEA_HOST=git.example.com REPO=x/y PR_NUMBER=1 TEAM=qa TEAM_ID=1 bash "$SCRIPT" 2>&1 || true)
 set -e
 assert_contains "T13 exits non-zero when GITEA_TOKEN missing" "GITEA_TOKEN required" "$T13_OUT"

@@ -308,12 +306,12 @@ echo
 echo "== T10 CURL_AUTH_FILE =="
 # Verify the token-file logic directly: create a temp file with the
 # same mktemp pattern, write the header with printf, chmod 600, then assert.
-T10_TOKEN="secret-fixture-token-abc123"
+T10_TOKEN="secret-test-token-abc123"
 T10_AUTHFILE=$(mktemp "${TMPDIR:-/tmp}/curl-auth.test.XXXXXX")
 chmod 600 "$T10_AUTHFILE"
 printf 'header = "Authorization: token %s"\n' "$T10_TOKEN" > "$T10_AUTHFILE"
 assert_file_mode "T10a mktemp authfile mode 600 (CURL_AUTH_FILE pattern)" "$T10_AUTHFILE" "600"
-assert_file_contains "T10b printf header format (CURL_AUTH_FILE content)" "$T10_AUTHFILE" "Authorization: token secret-fixture-token-abc123"
+assert_file_contains "T10b printf header format (CURL_AUTH_FILE content)" "$T10_AUTHFILE" "Authorization: token secret-test-token-abc123"
 assert_file_contains "T10c 'header =' curl-config syntax" "$T10_AUTHFILE" 'header = "Authorization: token '
 rm -f "$T10_AUTHFILE"

@@ -361,17 +359,6 @@ T17_RC=$(cat "$FIX_STATE_DIR/last_rc")
 assert_eq "T17 exit code 1 (no candidates from comments)" "1" "$T17_RC"
 assert_contains "T17 no candidates error" "no candidates from reviews API or issue comments" "$T17_OUT"

-# T18 — a wrong-team PR review candidate must not suppress a right-team
-# comment approval. This matches PR #1790, where QA had an APPROVED review
-# and security approved via the agent comment convention.
-echo
-echo "== T18 review candidate wrong team, comment candidate right team =="
-T18_OUT=$(run_review_check "T18_review_wrong_team_comment_right_team")
-T18_RC=$(cat "$FIX_STATE_DIR/last_rc")
-assert_eq "T18 exit code 0 (comment approval still considered)" "0" "$T18_RC"
-assert_contains "T18 comment candidate notice" "comment-based approval" "$T18_OUT"
-assert_contains "T18 comment approver accepted" "APPROVED by core-qa-agent" "$T18_OUT"
-
 echo
 echo "------"
 echo "PASS=$PASS FAIL=$FAIL"
@@ -14,7 +14,7 @@ def load_reaper():
    assert spec.loader is not None
    spec.loader.exec_module(mod)
    mod.API = "https://git.example.test/api/v1"
-    mod.GITEA_TOKEN = "fixture-token"
+    mod.GITEA_TOKEN = "test-token"
    mod.API_TIMEOUT_SEC = 1
    mod.API_RETRIES = 3
    mod.API_RETRY_SLEEP_SEC = 0
@@ -239,7 +239,7 @@ jobs:
              # Strip the package-import prefix so we can match .coverage-allowlist.txt
              # entries written as paths relative to workspace-server/.
              # Handle both module paths: platform/workspace-server/... and platform/...
-              rel=$(echo "$file" | sed 's|^git.moleculesai.app/molecule-ai/molecule-core/workspace-server/workspace-server/||; s|^git.moleculesai.app/molecule-ai/molecule-core/workspace-server/||')
+              rel=$(echo "$file" | sed 's|^github.com/molecule-ai/molecule-monorepo/platform/workspace-server/||; s|^github.com/molecule-ai/molecule-monorepo/platform/||')

              if echo "$ALLOWLIST" | grep -qxF "$rel"; then
                echo "::warning file=workspace-server/$rel::Critical file at ${pct}% coverage (allowlisted, #1823) — fix before expiry."
@@ -476,11 +476,7 @@ jobs:
    # jobs settle, leaving branch protection with a permanent pending
    # `CI / all-required` context. Instead, this independent sentinel polls the
    # required commit-status contexts for this SHA and fails if any fail, skip,
-    # or never emit. It runs the same path detector as `changes` and only waits
-    # for path-relevant jobs; Gitea can otherwise leave needs/output-skipped
-    # jobs permanently pending with "Blocked by required conditions". It runs on
-    # the dedicated `ci-meta` lane so the poller does not occupy the same
-    # general runner pool as the jobs it is waiting for.
+    # or never emit.
    #
    # canvas-deploy-reminder is intentionally NOT included in all-required.needs.
    # It is an informational main-push reminder, not a PR quality gate. Keeping
@@ -488,24 +484,9 @@ jobs:
    # sentinel before the `always()` guard can emit a branch-protection status.
    #
    continue-on-error: false
-    runs-on: ci-meta
+    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-      - id: check
-        env:
-          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-          PUSH_BEFORE: ${{ github.event.before }}
-        run: |
-          python3 .gitea/scripts/detect-changes.py \
-            --profile ci \
-            --event-name "${{ github.event_name }}" \
-            --pr-base-sha "$PR_BASE_SHA" \
-            --base-ref "$PR_BASE_REF" \
-            --push-before "${GITHUB_EVENT_BEFORE:-$PUSH_BEFORE}"
      - name: Wait for required CI contexts
        env:
          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -513,9 +494,6 @@ jobs:
          REPOSITORY: ${{ github.repository }}
          COMMIT_SHA: ${{ github.sha }}
          EVENT_NAME: ${{ github.event_name }}
-          REQUIRE_PLATFORM: ${{ steps.check.outputs.platform }}
-          REQUIRE_CANVAS: ${{ steps.check.outputs.canvas }}
-          REQUIRE_SCRIPTS: ${{ steps.check.outputs.scripts }}
        run: |
          set -euo pipefail
          python3 - <<'PY'
@@ -533,14 +511,11 @@ jobs:
          event = os.environ["EVENT_NAME"]
          required = [
              f"CI / Detect changes ({event})",
+              f"CI / Platform (Go) ({event})",
+              f"CI / Canvas (Next.js) ({event})",
+              f"CI / Shellcheck (E2E scripts) ({event})",
              f"CI / Python Lint & Test ({event})",
          ]
-          if os.environ.get("REQUIRE_PLATFORM") == "true":
-              required.append(f"CI / Platform (Go) ({event})")
-          if os.environ.get("REQUIRE_CANVAS") == "true":
-              required.append(f"CI / Canvas (Next.js) ({event})")
-          if os.environ.get("REQUIRE_SCRIPTS") == "true":
-              required.append(f"CI / Shellcheck (E2E scripts) ({event})")
          terminal_bad = {"failure", "error"}
          deadline = time.time() + 40 * 60
          last_summary = None
@@ -1,242 +0,0 @@
-name: E2E Legacy Advisory
-
-# Advisory lane for older/manual E2E scripts that are too broad or
-# environment-dependent for required PR CI. This intentionally does not run on
-# pull_request or push so it cannot block merges/deploys; scheduled/manual reds
-# still surface drift in scripts that would otherwise only be shellchecked.
-#
-# Gitea 1.22.6 rejects workflow_dispatch.inputs, so keep dispatch input-free.
-
-on:
-  schedule:
-    # Stagger after the staging smoke/canvas morning lanes.
-    - cron: '15 9 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: e2e-legacy-advisory
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-
-env:
-  GITHUB_SERVER_URL: https://git.moleculesai.app
-
-jobs:
-  legacy-local-platform:
-    name: Legacy local-platform E2E
-    runs-on: docker-host
-    timeout-minutes: 45
-    env:
-      PG_CONTAINER: pg-e2e-legacy-${{ github.run_id }}-${{ github.run_attempt }}
-      REDIS_CONTAINER: redis-e2e-legacy-${{ github.run_id }}-${{ github.run_attempt }}
-      MOLECULE_ENV: development
-      BIND_ADDR: 127.0.0.1
-      MOLECULE_IN_DOCKER: "false"
-      A2A_TIMEOUT: "30"
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
-        with:
-          go-version: 'stable'
-          cache: true
-          cache-dependency-path: workspace-server/go.sum
-
-      - name: Prepare local platform dependencies
-        run: |
-          set -euo pipefail
-          docker pull postgres:16 >/dev/null
-          docker pull redis:7 >/dev/null
-          docker pull alpine:latest >/dev/null
-          docker network create molecule-core-net >/dev/null 2>&1 || true
-
-      - name: Start Postgres
-        run: |
-          set -euo pipefail
-          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-          docker run -d --name "$PG_CONTAINER" \
-            -e POSTGRES_USER=dev -e POSTGRES_PASSWORD=dev -e POSTGRES_DB=molecule \
-            -p 0:5432 postgres:16 >/dev/null
-          PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
-          if [ -z "$PG_PORT" ]; then
-            PG_PORT=$(docker port "$PG_CONTAINER" 5432/tcp | head -1 | awk -F: '{print $NF}')
-          fi
-          if [ -z "$PG_PORT" ]; then
-            echo "::error::Could not resolve host port for $PG_CONTAINER"
-            docker port "$PG_CONTAINER" 5432/tcp || true
-            docker logs "$PG_CONTAINER" || true
-            exit 1
-          fi
-          echo "DATABASE_URL=postgres://dev:dev@127.0.0.1:${PG_PORT}/molecule?sslmode=disable" >> "$GITHUB_ENV"
-          for i in $(seq 1 30); do
-            docker exec "$PG_CONTAINER" pg_isready -U dev >/dev/null 2>&1 && exit 0
-            sleep 1
-          done
-          docker logs "$PG_CONTAINER" || true
-          exit 1
-
-      - name: Start Redis
-        run: |
-          set -euo pipefail
-          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
-          docker run -d --name "$REDIS_CONTAINER" -p 0:6379 redis:7 >/dev/null
-          REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | awk -F: '/^0\.0\.0\.0:/ {print $2; exit}')
-          if [ -z "$REDIS_PORT" ]; then
-            REDIS_PORT=$(docker port "$REDIS_CONTAINER" 6379/tcp | head -1 | awk -F: '{print $NF}')
-          fi
-          if [ -z "$REDIS_PORT" ]; then
-            echo "::error::Could not resolve host port for $REDIS_CONTAINER"
-            docker port "$REDIS_CONTAINER" 6379/tcp || true
-            docker logs "$REDIS_CONTAINER" || true
-            exit 1
-          fi
-          echo "REDIS_URL=redis://127.0.0.1:${REDIS_PORT}" >> "$GITHUB_ENV"
-          for i in $(seq 1 15); do
-            docker exec "$REDIS_CONTAINER" redis-cli ping 2>/dev/null | grep -q PONG && exit 0
-            sleep 1
-          done
-          docker logs "$REDIS_CONTAINER" || true
-          exit 1
-
-      - name: Pick platform port
-        run: |
-          set -euo pipefail
-          PLATFORM_PORT=$(python3 - <<'PY'
-          import socket
-          with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-              s.bind(("127.0.0.1", 0))
-              print(s.getsockname()[1])
-          PY
-          )
-          echo "PORT=${PLATFORM_PORT}" >> "$GITHUB_ENV"
-          echo "BASE=http://127.0.0.1:${PLATFORM_PORT}" >> "$GITHUB_ENV"
-
-      - name: Build platform
-        working-directory: workspace-server
-        run: go build -o platform-server ./cmd/server
-
-      - name: Populate template manifests for dev-mode E2E
-        run: |
-          set -euo pipefail
-          if command -v jq >/dev/null 2>&1; then
-            bash scripts/clone-manifest.sh manifest.json workspace-configs-templates org-templates plugins
-          else
-            echo "::warning::jq unavailable; dev-mode template assertion may fail if templates are absent"
-          fi
-
-      - name: Start platform
-        run: |
-          set -euo pipefail
-          ./workspace-server/platform-server > workspace-server/platform.log 2>&1 &
-          echo $! > workspace-server/platform.pid
-          for i in $(seq 1 30); do
-            curl -sf "$BASE/health" >/dev/null && exit 0
-            sleep 1
-          done
-          cat workspace-server/platform.log || true
-          exit 1
-
-      - name: Run comprehensive E2E
-        run: bash tests/e2e/test_comprehensive_e2e.sh
-
-      - name: Run workspace abilities E2E
-        run: bash tests/e2e/test_workspace_abilities_e2e.sh
-
-      - name: Run dev-mode E2E
-        run: bash tests/e2e/test_dev_mode.sh
-
-      - name: Start stub A2A agents
-        run: |
-          set -euo pipefail
-          cat > /tmp/molecule-stub-a2a.py <<'PY'
-          import json
-          from http.server import BaseHTTPRequestHandler, HTTPServer
-
-          class Handler(BaseHTTPRequestHandler):
-              def do_POST(self):
-                  length = int(self.headers.get("content-length", "0"))
-                  raw = self.rfile.read(length) if length else b"{}"
-                  try:
-                      req = json.loads(raw)
-                  except Exception:
-                      req = {}
-                  method = req.get("method")
-                  if method not in ("message/send", None):
-                      body = {"jsonrpc": "2.0", "id": req.get("id"), "error": {"code": -32601, "message": "method not found"}}
-                  else:
-                      body = {
-                          "jsonrpc": "2.0",
-                          "id": req.get("id", "stub"),
-                          "result": {
-                              "role": "agent",
-                              "parts": [{"kind": "text", "type": "text", "text": "stub agent response"}],
-                          },
-                      }
-                  data = json.dumps(body, separators=(",", ":")).encode()
-                  self.send_response(200)
-                  self.send_header("content-type", "application/json")
-                  self.send_header("content-length", str(len(data)))
-                  self.end_headers()
-                  self.wfile.write(data)
-              def log_message(self, *_):
-                  return
-
-          HTTPServer(("127.0.0.1", 18080), Handler).serve_forever()
-          PY
-          python3 /tmp/molecule-stub-a2a.py > /tmp/molecule-stub-a2a.log 2>&1 &
-          echo $! > /tmp/molecule-stub-a2a.pid
-
-      - name: Seed external agents for legacy A2A/activity scripts
-        run: |
-          set -euo pipefail
-          create_agent() {
-            local name="$1" role="$2"
-            curl -sS -X POST "$BASE/workspaces" \
-              -H "Content-Type: application/json" \
-              -d "{\"name\":\"${name}\",\"role\":\"${role}\",\"tier\":1,\"runtime\":\"external\",\"external\":true,\"url\":\"http://127.0.0.1:18080\"}" \
-              | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])"
-          }
-          ECHO_ID=$(create_agent "Echo Agent" "Echo")
-          SEO_ID=$(create_agent "SEO Agent" "SEO")
-          curl -sS -X POST "$BASE/registry/register" -H "Content-Type: application/json" \
-            -d "{\"id\":\"$ECHO_ID\",\"url\":\"http://127.0.0.1:18080\",\"agent_card\":{\"name\":\"Echo Agent\",\"skills\":[{\"id\":\"echo\",\"name\":\"Echo\"}]}}" >/dev/null
-          curl -sS -X POST "$BASE/registry/register" -H "Content-Type: application/json" \
-            -d "{\"id\":\"$SEO_ID\",\"url\":\"http://127.0.0.1:18080\",\"agent_card\":{\"name\":\"SEO Agent\",\"skills\":[{\"id\":\"seo\",\"name\":\"SEO\"}]}}" >/dev/null
-
-      - name: Run activity E2E
-        run: bash tests/e2e/test_activity_e2e.sh
-
-      - name: Run A2A E2E
-        run: bash tests/e2e/test_a2a_e2e.sh
-
-      - name: Runtime-dependent legacy E2E preflight
-        run: |
-          set -euo pipefail
-          if [ -f workspace-configs-templates/claude-code-default/.auth-token ] && docker image inspect workspace:latest >/dev/null 2>&1; then
-            bash tests/e2e/test_claude_code_e2e.sh
-            bash tests/e2e/test_chat_upload_e2e.sh
-          else
-            echo "::notice::Skipping test_claude_code_e2e.sh and test_chat_upload_e2e.sh: require workspace:latest plus workspace-configs-templates/claude-code-default/.auth-token"
-          fi
-
-      - name: Dump platform log on failure
-        if: failure()
-        run: cat workspace-server/platform.log || true
-
-      - name: Stop platform and stub agents
-        if: always()
-        run: |
-          if [ -f workspace-server/platform.pid ]; then
-            kill "$(cat workspace-server/platform.pid)" 2>/dev/null || true
-          fi
-          if [ -f /tmp/molecule-stub-a2a.pid ]; then
-            kill "$(cat /tmp/molecule-stub-a2a.pid)" 2>/dev/null || true
-          fi
-
-      - name: Stop service containers
-        if: always()
-        run: |
-          docker rm -f "$PG_CONTAINER" 2>/dev/null || true
-          docker rm -f "$REDIS_CONTAINER" 2>/dev/null || true
@@ -143,9 +143,8 @@ jobs:
          echo "test_peer_visibility_token_mint_staging.sh — bash syntax OK"
          bash -n tests/e2e/test_peer_visibility_mcp_local.sh
          echo "test_peer_visibility_mcp_local.sh — bash syntax OK"
-          legacy_token_suffix="test""-token"
-          if rg -n "$legacy_token_suffix" tests/e2e/test_*staging*.sh; then
-            echo "::error::staging E2E must use production-safe admin token minting"
+          if rg -n '/admin/workspaces/.*/test-token|test-token' tests/e2e/test_*staging*.sh; then
+            echo "::error::staging E2E must not use dev-only /admin/workspaces/:id/test-token; use production-safe admin token minting instead"
            exit 1
          fi
          echo "Staging fresh-provision MCP list_peers E2E runs on push to"
@@ -108,13 +108,13 @@ jobs:
        # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
        continue-on-error: true

-  # Actual E2E: runs on trunk pushes and PRs that touch provisioning-critical
-  # paths. pr-validate remains as the lightweight workflow-shape check for PRs,
-  # but it is not a substitute for live staging proof when this workflow or the
-  # staging harness changes.
+  # Actual E2E: runs on trunk pushes (main + staging). NOT the PR-fire-only
+  # path — pr-validate above posts success for workflow-only PRs.
  e2e-staging-saas:
    name: E2E Staging SaaS
    runs-on: ubuntu-latest
+    # Only runs on trunk pushes. PR paths get pr-validate instead.
+    if: github.event.pull_request.base.ref == ''
    # Phase 3 (RFC #219 §1): surface broken workflows without blocking.
    # mc#774: pre-existing continue-on-error mask; root-fix and remove, do not renew silently.
    continue-on-error: true
@@ -152,7 +152,7 @@ jobs:
      # block). See #2578 PR comment for the rationale.
      E2E_ANTHROPIC_API_KEY: ${{ secrets.MOLECULE_STAGING_ANTHROPIC_API_KEY }}
      # OpenAI fallback — kept wired so an operator-dispatched run with
-      # E2E_RUNTIME=hermes or =codex via workflow_dispatch can still
+      # E2E_RUNTIME=hermes or =langgraph via workflow_dispatch can still
      # exercise the OpenAI path.
      E2E_OPENAI_API_KEY: ${{ secrets.MOLECULE_STAGING_OPENAI_API_KEY }}
      E2E_RUNTIME: ${{ github.event.inputs.runtime || 'claude-code' }}
@@ -161,7 +161,7 @@ jobs:
      # and defeats the cost saving. Operators can override via the
      # workflow_dispatch flow (no input wired here yet — runtime
      # override is enough for ad-hoc).
-      E2E_MODEL_SLUG: ${{ github.event.inputs.runtime == 'hermes' && 'openai/gpt-4o' || github.event.inputs.runtime == 'codex' && 'openai/gpt-4o' || 'MiniMax-M2' }}
+      E2E_MODEL_SLUG: ${{ github.event.inputs.runtime == 'hermes' && 'openai/gpt-4o' || github.event.inputs.runtime == 'langgraph' && 'openai:gpt-4o' || 'MiniMax-M2' }}
      E2E_RUN_ID: "${{ github.run_id }}-${{ github.run_attempt }}"
      E2E_KEEP_ORG: ${{ github.event.inputs.keep_org && '1' || '0' }}

@@ -185,7 +185,7 @@ jobs:
      - name: Verify LLM key present
        run: |
          # Per-runtime key check — claude-code uses MiniMax; hermes /
-          # codex (operator-dispatched only) use OpenAI. Hard-fail
+          # langgraph (operator-dispatched only) use OpenAI. Hard-fail
          # rather than soft-skip per #2578's lesson — empty key
          # silently falls through to the wrong SECRETS_JSON branch and
          # produces a confusing auth error 5 min later instead of the
@@ -206,7 +206,7 @@ jobs:
                required_secret_value=""
              fi
              ;;
-            codex|hermes)
+            langgraph|hermes)
              required_secret_name="MOLECULE_STAGING_OPENAI_API_KEY"
              required_secret_value="${E2E_OPENAI_API_KEY:-}"
              ;;
@@ -32,24 +32,6 @@ on:
  # iterating all open PRs when PR_NUMBER is empty.
  workflow_dispatch:

-# Serialize per PR (or per repo for schedule/manual ticks) to prevent
-# the fan-out OOM class documented in
-# `reference_operator_host_python3_oom_storm_2026_05_18`. `edited`
-# events fan out on every PR-body edit; combined with the hourly cron
-# and synchronize bursts this workflow can stack runs of the same
-# workflow_id on the same PR (each ~4GB anon-RSS) and trip the
-# `--memory=4g --memory-swap=8g` per-container cap.
-#
-# NO `cancel-in-progress` (defaults to false). Per
-# `feedback_janitor_supersede_must_group_by_workflow_id`, cancelling
-# in-flight runs of any required-check-shaped workflow risks the
-# dismiss_stale_approvals + empty-commit-rerun dance (Gitea 1.22.6 has
-# no REST rerun). The gate-check is `continue-on-error: true` +
-# idempotent (POST/PATCH gate-check comment by context) so sequential
-# ticks are strictly safe.
-concurrency:
-  group: gate-check-v3-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
-
 permissions:
  # read: contents — for checkout (base ref, not PR head for security)
  # read: pull-requests — for reading PR info via API
@@ -303,19 +303,26 @@ jobs:
          python3 .gitea/scripts/prod-auto-deploy.py assert-enabled
          PLAN="$RUNNER_TEMP/prod-auto-deploy-plan.json"
          TARGET_TAG="$(jq -r '.target_tag' "$PLAN")"
+          BODY="$(jq -c '.body' "$PLAN")"
+
+          echo "POST $CP_URL/cp/admin/tenants/redeploy-fleet"
+          echo "  target_tag: $TARGET_TAG"
+          echo "  body: $BODY"

          HTTP_RESPONSE="$RUNNER_TEMP/prod-redeploy-response.json"
+          HTTP_CODE_FILE="$RUNNER_TEMP/prod-redeploy-http-code.txt"
          set +e
-          python3 .gitea/scripts/prod-auto-deploy.py rollout \
-            --plan "$PLAN" \
-            --response "$HTTP_RESPONSE"
-          ROLLOUT_EXIT=$?
+          curl -sS -o "$HTTP_RESPONSE" -w '%{http_code}' \
+            -m 1200 \
+            -H "Authorization: Bearer $CP_ADMIN_API_TOKEN" \
+            -H "Content-Type: application/json" \
+            -X POST "$CP_URL/cp/admin/tenants/redeploy-fleet" \
+            -d "$BODY" > "$HTTP_CODE_FILE"
          set -e

-          if [ ! -s "$HTTP_RESPONSE" ]; then
-            jq -nc --arg error "rollout command exited $ROLLOUT_EXIT before writing a response" \
-              '{ok:false, results:[], error:$error}' > "$HTTP_RESPONSE"
-          fi
+          HTTP_CODE="$(cat "$HTTP_CODE_FILE" 2>/dev/null || echo "000")"
+          [ -z "$HTTP_CODE" ] && HTTP_CODE="000"
+          echo "HTTP $HTTP_CODE"
          jq '{ok, result_count: (.results // [] | length)}' "$HTTP_RESPONSE" || true

          {
@@ -323,6 +330,7 @@ jobs:
            echo ""
            echo "**Commit:** \`${GITHUB_SHA:0:7}\`"
            echo "**Target tag:** \`$TARGET_TAG\`"
+            echo "**HTTP:** $HTTP_CODE"
            echo ""
            echo "### Per-tenant result"
            echo ""
@@ -331,15 +339,15 @@ jobs:
            jq -r '.results[]? | "| \(.slug) | \(.phase) | \(.ssm_status // "-") | \(.ssm_exit_code) | \(.healthz_ok) | \((.error // "") != "") |"' "$HTTP_RESPONSE" || true
          } >> "$GITHUB_STEP_SUMMARY"

+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "::error::redeploy-fleet returned HTTP $HTTP_CODE"
+            exit 1
+          fi
          OK="$(jq -r '.ok' "$HTTP_RESPONSE")"
          if [ "$OK" != "true" ]; then
            echo "::error::redeploy-fleet reported ok=false; production rollout halted."
            exit 1
          fi
-          if [ "$ROLLOUT_EXIT" -ne 0 ]; then
-            echo "::error::redeploy-fleet rollout failed with exit code $ROLLOUT_EXIT."
-            exit "$ROLLOUT_EXIT"
-          fi

      - name: Verify reachable tenants report this SHA
        if: ${{ steps.plan.outputs.enabled == 'true' }}
@@ -106,7 +106,7 @@ jobs:
              [[ "$file" == *_test.go ]] && continue
              [[ "$file" == *"$path"* ]] || continue
              awk "BEGIN{exit !(\$pct < 10)}" || continue
-              rel=$(echo "$file" | sed 's|^git.moleculesai.app/molecule-ai/molecule-core/workspace-server/workspace-server/||; s|^git.moleculesai.app/molecule-ai/molecule-core/workspace-server/||')
+              rel=$(echo "$file" | sed 's|^github.com/molecule-ai/molecule-monorepo/platform/workspace-server/||; s|^github.com/molecule-ai/molecule-monorepo/platform/||')
              if echo "$ALLOWLIST" | grep -qxF "$rel"; then
                continue
              fi
@@ -53,7 +53,7 @@ Molecule AI is the most powerful way to govern an AI agent organization in produ
 It combines the parts that are usually scattered across demos, internal glue code, and framework-specific tooling into one product:

 - one org-native control plane for teams, roles, hierarchy, and lifecycle
- one runtime layer that lets **four** maintained agent runtimes — Claude Code, Codex, **Hermes**, and OpenClaw — run side by side behind one workspace contract
+- one runtime layer that lets **eight** agent runtimes — LangGraph, DeepAgents, Claude Code, CrewAI, AutoGen, **Hermes**, **Gemini CLI**, and OpenClaw — run side by side behind one workspace contract
 - one memory model that keeps recall, sharing, and skill evolution aligned with organizational boundaries (Memory v2 backed by pgvector for semantic recall)
 - one operational surface for observing, pausing, restarting, inspecting, and improving live workspaces

@@ -75,11 +75,11 @@ You do not wire collaboration paths by hand. Hierarchy defines the default commu

 ### 3. Runtime choice stops being a dead-end decision

-Claude Code, Codex, Hermes, and OpenClaw can all plug into the same workspace abstraction. Teams can standardize governance without forcing every group onto one runtime.
+LangGraph, DeepAgents, Claude Code, CrewAI, AutoGen, Hermes, Gemini CLI, and OpenClaw can all plug into the same workspace abstraction. Teams can standardize governance without forcing every group onto one runtime.

 ### 4. Memory is treated like infrastructure

-Molecule AI's HMA approach is designed around organizational boundaries, not just "store more context somewhere." Durable recall, scoped sharing through the v2 memory plugin, and skill promotion are all part of one coherent system.
+Molecule AI's HMA approach is designed around organizational boundaries, not just “store more context somewhere.” Durable recall, scoped sharing, awareness namespaces, and skill promotion are all part of one coherent system.

 ### 5. It comes with a real control plane

@@ -101,7 +101,7 @@ Registry, heartbeats, restart, pause/resume, activity logs, approvals, terminal
 | **Role-native workspace abstraction** | Your org structure survives model swaps, framework changes, and team expansion |
 | **Fractal team expansion** | A single specialist can become a managed department without breaking upstream integrations |
 | **Heterogeneous runtime compatibility** | Different teams can keep their preferred agent architecture while sharing one control plane |
-| **HMA + v2 memory plugin** | Memory sharing follows hierarchy instead of leaking across the whole system; one plugin per tenant, namespace-scoped per workspace |
+| **HMA + awareness namespaces** | Memory sharing follows hierarchy instead of leaking across the whole system |
 | **Skill evolution loop** | Durable successful workflows can graduate from memory into reusable, hot-reloadable skills |
 | **WebSocket-first operational UX** | The canvas reflects task state, structure changes, and A2A responses in near real time |
 | **Global secrets with local override** | Centralize provider access, then override only where a workspace needs specialized credentials |
@@ -112,9 +112,13 @@ Molecule AI is not trying to replace the frameworks below. It is the system that

 | Runtime / architecture | Status in current repo | Native strength | What Molecule AI adds |
 |---|---|---|---|
+| **LangGraph** | Shipping on `main` | Graph control, tool use, Python extensibility | Canvas orchestration, hierarchy routing, A2A, memory scopes, operational lifecycle |
+| **DeepAgents** | Shipping on `main` | Deeper planning and decomposition | Same workspace contract, team topology, activity stream, restart behavior |
 | **Claude Code** | Shipping on `main` | Real coding workflows, CLI-native continuity | Secure workspace abstraction, A2A delegation, org boundaries, shared control plane |
-| **Codex** | Shipping on `main` | OpenAI Codex CLI workflows | Secure workspace abstraction, A2A delegation, org boundaries, shared control plane |
+| **CrewAI** | Shipping on `main` | Role-based crews | Persistent workspace identity, policy consistency, shared canvas and registry |
+| **AutoGen** | Shipping on `main` | Assistant/tool orchestration | Standardized deployment, hierarchy-aware collaboration, shared ops plane |
 | **Hermes 4** | Shipping on `main` | Hybrid reasoning, native tools, json_schema (NousResearch/hermes-agent) | Option B upstream hook, A2A bridge to OpenAI-compat API, multi-provider provider derivation |
+| **Gemini CLI** | Shipping on `main` | Google Gemini CLI continuity | Workspace lifecycle, A2A, hierarchy-aware collaboration, shared ops plane |
 | **OpenClaw** | Shipping on `main` | CLI-native runtime with its own session model | Workspace lifecycle, templates, activity logs, topology-aware collaboration |
 | **NemoClaw** | WIP on `feat/nemoclaw-t4-docker` | NVIDIA-oriented runtime path | Planned to join the same abstraction once merged; not yet part of `main` |

@@ -129,7 +133,7 @@ Most projects stop at “we added memory.” Molecule AI pushes further:
 | Flat store or weak namespaces | Hierarchy-aligned `LOCAL`, `TEAM`, `GLOBAL` scopes |
 | Sharing is easy to overexpose | Sharing is explicit and structure-aware |
 | Memory and procedure get mixed together | Memory stores durable facts; skills store repeatable procedure |
-| Every agent can become over-privileged | Per-workspace namespaces in the v2 memory plugin reduce blast radius |
+| Every agent can become over-privileged | Workspace awareness namespaces reduce blast radius |
 | UI memory and runtime memory blur together | Separate surfaces for scoped agent memory, key/value workspace memory, and recall |

 ### The flywheel
@@ -159,7 +163,7 @@ Most agent systems stop at "a smart runtime." Molecule AI pushes further: it giv

 | Core mechanism | Molecule AI module(s) | Why it matters |
 |---|---|---|
-| **Durable memory that survives sessions** | `molecule-ai-workspace-runtime/molecule_runtime/builtin_tools/`, `workspace-server/internal/handlers/memories.go`, `workspace-server/internal/memory/` (v2 plugin client + namespace resolver) | Memory is not just durable, it is **workspace-scoped** — every write lands in the workspace's own `workspace:<id>` namespace, with `team:<root>` and `org:<root>` available for cross-workspace shares via the platform's namespace ACL when an agent explicitly promotes a memory |
+| **Durable memory that survives sessions** | `molecule-ai-workspace-runtime/molecule_runtime/builtin_tools/`, `workspace-server/internal/handlers/memories.go` | Memory is not just durable, it is **workspace-scoped** and can route into awareness namespaces tied to the org structure |
 | **Cross-session recall** | `workspace-server/internal/handlers/activity.go` (`/workspaces/:id/session-search`) | Recall spans both activity history and memory rows, so the system can search what happened and what was learned without inventing a separate hidden store |
 | **Skills built from experience** | `molecule-ai-workspace-runtime/molecule_runtime/builtin_tools/memory.py` (`_maybe_log_skill_promotion`) | Promotion from memory into a skill candidate is surfaced as an explicit platform activity, not a silent internal side effect |
 | **Skill improvement during use** | `molecule-ai-workspace-runtime/molecule_runtime/skill_loader/`, `molecule-ai-workspace-runtime/molecule_runtime/main.py` | Skills hot-reload into the live runtime, so improvements become available on the next A2A task without restarting the workspace |
@@ -168,7 +172,7 @@ Most agent systems stop at "a smart runtime." Molecule AI pushes further: it giv
 ### Why this matters in Molecule AI

 1. **The learning loop is org-aware, not just session-aware.**
-   Memory can live at `LOCAL`, `TEAM`, or `GLOBAL` scope, and the v2 plugin's namespace ACL gives each workspace a durable identity boundary.
+   Memory can live at `LOCAL`, `TEAM`, or `GLOBAL` scope, and awareness namespaces give each workspace a durable identity boundary.

 2. **The learning loop is visible to operators.**
   Promotion events, activity logs, current-task updates, traces, and WebSocket fanout mean self-improvement is part of the control plane, not a hidden black box.
@@ -205,9 +209,9 @@ The result is not just “an agent that learns.” It is **an organization that
 ### Runtime

 - standalone workspace-template images that install `molecule-ai-workspace-runtime` from the Gitea package registry; thin AMI in production (us-east-2)
- adapter-driven execution across **4 maintained runtimes** (Claude Code, Codex, Hermes, OpenClaw)
+- adapter-driven execution across **8 runtimes** (Claude Code, Hermes, Gemini CLI, LangGraph, DeepAgents, CrewAI, AutoGen, OpenClaw)
 - Agent Card registration
- **Memory v2 backed by pgvector** — per-tenant plugin sidecar serving HMA namespaces with FTS + semantic recall
+- awareness-backed memory integration; **Memory v2 backed by pgvector** for semantic recall
 - plugin-mounted shared rules/skills
 - hot-reloadable local skills
 - coordinator-only delegation path
@@ -241,7 +245,7 @@ The result is not just “an agent that learns.” It is **an organization that
 Molecule AI is especially strong when you need to run:

 - AI engineering teams with PM / Dev Lead / QA / Research / Ops roles
- mixed runtime organizations where one team prefers Hermes and another prefers Claude Code
+- mixed runtime organizations where one team prefers LangGraph and another prefers Claude Code
 - long-lived agent organizations that need memory boundaries and reusable procedures
 - internal platforms that want to expose agent teams as structured infrastructure, not ad hoc scripts

@@ -256,9 +260,9 @@ Canvas (Next.js 15, warm-paper :3000)  <--HTTP / WS-->  Platform (Go 1.25 :8080)
         +------------------------- shows ------------------------> workspaces, teams, tasks, traces, events

 Workspace Runtime (Python ≥3.11, image with adapters)
-  - 4 adapters: Claude Code / Codex / Hermes / OpenClaw
+  - 8 adapters: LangGraph / DeepAgents / Claude Code / CrewAI / AutoGen / Hermes / Gemini CLI / OpenClaw
  - Agent Card + A2A server (typed-SSOT response path, RFC #2967)
-  - heartbeat + activity + Memory v2 (pgvector semantic recall via per-tenant plugin sidecar)
+  - heartbeat + activity + awareness-backed memory (Memory v2 — pgvector semantic recall)
  - skills + plugins + hot reload

 SaaS Control Plane (molecule-controlplane, private)
@@ -324,7 +328,7 @@ Then open `http://localhost:3000`:

 ## Current Scope

-The current `main` branch ships the core platform, Canvas v4 (warm-paper themed), Memory v2 (pgvector semantic recall), the typed-SSOT A2A response path (RFC #2967), **four maintained production adapters** (Claude Code, Codex, Hermes, OpenClaw), skill lifecycle, and operational surfaces.
+The current `main` branch ships the core platform, Canvas v4 (warm-paper themed), Memory v2 (pgvector semantic recall), the typed-SSOT A2A response path (RFC #2967), **eight production adapters** (Claude Code, Hermes, Gemini CLI, LangGraph, DeepAgents, CrewAI, AutoGen, OpenClaw), skill lifecycle, and operational surfaces.

 The companion private repo [`molecule-controlplane`](https://git.moleculesai.app/molecule-ai/molecule-controlplane) provides the SaaS surface — multi-tenant orchestration on EC2 + Neon + Cloudflare Tunnels, KMS envelope encryption, WorkOS auth, Stripe billing, and a `tenant_resources` audit table with a 30-min reconciler.

@@ -52,7 +52,7 @@ Molecule AI 是目前最强的 AI Agent 组织治理方案之一，用来把 age
 它把过去分散在 demo、内部胶水代码和各类 framework 私有工具里的关键能力，收敛成一个产品：

 - 一套组织原生 control plane，管理团队、角色、层级和生命周期
- 一套 runtime abstraction，让 **4 个**维护中的 agent runtime —— Claude Code、Codex、**Hermes**、OpenClaw —— 共用一套 workspace 契约
+- 一套 runtime abstraction，让 **8 个** agent runtime —— LangGraph、DeepAgents、Claude Code、CrewAI、AutoGen、**Hermes**、**Gemini CLI**、OpenClaw —— 共用一套 workspace 契约
 - 一套与组织边界对齐的 memory 模型，把 recall、sharing 和 skill evolution 放进同一体系（Memory v2 由 pgvector 支撑语义召回）
 - 一套面向线上 workspace 的运维面，统一完成观测、暂停、重启、检查和持续改进

@@ -74,11 +74,11 @@ Molecule AI 填的就是这个空白。

 ### 3. Runtime 选择不再是死路

-Claude Code、Codex、Hermes、OpenClaw 都可以挂到同一个 workspace abstraction 下。团队可以统一治理方式，而不必统一到底层 runtime。
+LangGraph、DeepAgents、Claude Code、CrewAI、AutoGen、Hermes、Gemini CLI、OpenClaw 都可以挂到同一个 workspace abstraction 下。团队可以统一治理方式，而不必统一到底层 runtime。

 ### 4. Memory 被当成基础设施来做

-Molecule AI 的 HMA 不是“多存一点上下文”而已。它关注组织边界、durable recall、scope sharing、v2 memory plugin、skill promotion，把这些放在一个完整体系里。
+Molecule AI 的 HMA 不是“多存一点上下文”而已。它关注组织边界、durable recall、scope sharing、awareness namespace、skill promotion，把这些放在一个完整体系里。

 ### 5. 它自带真正的 control plane

@@ -100,7 +100,7 @@ Registry、heartbeat、restart、pause/resume、activity、approval、terminal
 | **角色原生 workspace 抽象** | 模型切换、框架切换、团队扩容都不会打碎你的组织结构 |
 | **分形式团队扩展** | 一个 specialist 可以平滑升级成一个部门，而不影响上游集成 |
 | **异构 runtime 兼容** | 不同团队可以保留偏好的 agent 架构，但共用一套平台规则 |
-| **HMA + v2 memory plugin** | Memory 分享沿组织边界走，而不是全局乱穿透；每个 tenant 一个 plugin，按 workspace namespace 隔离 |
+| **HMA + awareness namespace** | Memory 分享沿组织边界走，而不是全局乱穿透 |
 | **Skill 演化闭环** | 成功工作流可以从 memory 逐步提升成可热加载的 skill |
 | **WebSocket-first 运维体验** | Canvas 能即时反映任务状态、结构变更和 A2A 响应 |
 | **Global secrets + local override** | 统一管理 provider 凭据，只在需要时做 workspace 级覆写 |
@@ -111,9 +111,13 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更

 | Runtime / 架构 | 当前仓库状态 | 原生优势 | Molecule AI 额外补上的能力 |
 |---|---|---|---|
+| **LangGraph** | `main` 已支持 | 图控制强、工具调用成熟、Python 扩展性好 | Canvas orchestration、层级路由、A2A、memory scope、operational lifecycle |
+| **DeepAgents** | `main` 已支持 | 规划和任务拆解更强 | 同一套 workspace contract、团队拓扑、activity、restart 行为 |
 | **Claude Code** | `main` 已支持 | 真实编码工作流、CLI-native continuity | 安全 workspace 抽象、A2A delegation、组织边界、共享 control plane |
-| **Codex** | `main` 已支持 | OpenAI Codex CLI 工作流 | 安全 workspace 抽象、A2A delegation、组织边界、共享 control plane |
+| **CrewAI** | `main` 已支持 | 角色型 crew 模式清晰 | 持久 workspace 身份、统一策略、共享 Canvas 和 registry |
+| **AutoGen** | `main` 已支持 | assistant/tool orchestration | 统一部署、层级协作、共享运维平面 |
 | **Hermes 4** | `main` 已支持 | 混合推理、原生工具调用、json_schema 输出（NousResearch/hermes-agent） | Option B 上游 hook、A2A 桥接 OpenAI 兼容 API、多 provider 自动派生 |
+| **Gemini CLI** | `main` 已支持 | Google Gemini CLI 持续会话 | workspace 生命周期、A2A、层级感知协作、共享运维平面 |
 | **OpenClaw** | `main` 已支持 | CLI-native runtime，自有 session 模型 | workspace 生命周期、templates、activity logs、拓扑感知协作 |
 | **NemoClaw** | `feat/nemoclaw-t4-docker` 分支 WIP | NVIDIA 方向 runtime 路线 | 计划并入同一抽象层，但当前还不是 `main` 已合并能力 |

@@ -128,7 +132,7 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更
 | 扁平 store 或弱命名空间隔离 | 与层级对齐的 `LOCAL`、`TEAM`、`GLOBAL` scope |
 | 分享很容易越界 | 分享是显式且结构感知的 |
 | Memory 和 procedure 混成一团 | Memory 存 durable facts，skills 存 repeatable procedure |
-| 任意 agent 容易过权 | v2 memory plugin 的 per-workspace namespace 缩小 blast radius |
+| 任意 agent 容易过权 | workspace awareness namespace 缩小 blast radius |
 | UI memory 和 runtime memory 混在一起 | scoped agent memory、key/value workspace memory、recall surface 分层清晰 |

 ### 这套飞轮怎么转
@@ -158,7 +162,7 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更

 | 核心机制 | Molecule AI 对应模块 | 为什么重要 |
 |---|---|---|
-| **跨 session 的 durable memory** | `workspace/builtin_tools/memory.py`、`workspace-server/internal/handlers/memories.go`、`workspace-server/internal/memory/`（v2 plugin client + namespace resolver）| 不只是持久化，而且是**按 workspace 隔离**的 —— 每次写入都落在 workspace 自己的 `workspace:<id>` namespace 里；当 agent 显式升级到跨 workspace 共享时，可以通过平台 namespace ACL 写到 `team:<root>` 和 `org:<root>` |
+| **跨 session 的 durable memory** | `workspace/builtin_tools/memory.py`、`workspace/builtin_tools/awareness_client.py`、`workspace-server/internal/handlers/memories.go` | 不只是持久化，而且是**按 workspace 隔离**的，可进一步路由到和组织结构绑定的 awareness namespace |
 | **Cross-session recall** | `workspace-server/internal/handlers/activity.go` 中的 `/workspaces/:id/session-search` | Recall 同时覆盖 activity history 和 memory rows，不需要再造一个隐蔽的新存储层 |
 | **从经验里长出技能** | `workspace/builtin_tools/memory.py` 里的 `_maybe_log_skill_promotion` | 从 memory 到 skill candidate 的提升会被显式记录成平台 activity，而不是默默发生在黑盒里 |
 | **技能在使用中持续改进** | `workspace/skill_loader/watcher.py`、`workspace/skill_loader/loader.py`、`workspace/main.py` | Skill 改动可以热加载进 live runtime，下一次 A2A 任务就能直接使用，不需要重启 workspace |
@@ -167,7 +171,7 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更
 ### 为什么这在 Molecule AI 里更适合团队级系统

 1. **学习闭环是 org-aware 的，而不只是 session-aware。**
-   Memory 可以按 `LOCAL`、`TEAM`、`GLOBAL` scope 运作，v2 plugin 的 namespace ACL 让每个 workspace 都有清晰的持久边界。
+   Memory 可以按 `LOCAL`、`TEAM`、`GLOBAL` scope 运作，awareness namespace 让每个 workspace 都有清晰的持久边界。

 2. **学习闭环是对运维可见的。**
   Promotion events、activity logs、current-task updates、traces、WebSocket fanout 让自我进化进入 control plane，而不是藏在黑盒内部。
@@ -204,9 +208,9 @@ Molecule AI 并不是要替代下面这些 framework，而是把它们纳入更
 ### Runtime

 - 统一 `workspace/` 镜像；生产环境采用 thin AMI（us-east-2）
- adapter 驱动执行，覆盖 **4 个维护中的 runtime**（Claude Code、Codex、Hermes、OpenClaw）
+- adapter 驱动执行，覆盖 **8 个 runtime**（Claude Code、Hermes、Gemini CLI、LangGraph、DeepAgents、CrewAI、AutoGen、OpenClaw）
 - Agent Card 注册
- **Memory v2 由 pgvector 支撑** —— 每个 tenant 一个 plugin sidecar，承载 HMA namespace、FTS 与语义召回
+- awareness-backed memory；**Memory v2 由 pgvector 支撑**语义召回
 - plugin 挂载共享 rules/skills
 - 本地 skills 热加载
 - coordinator-only delegation 路径
@@ -255,9 +259,9 @@ Canvas (Next.js 15, warm-paper :3000)  <--HTTP / WS-->  Platform (Go 1.25 :8080)
         +------------------------- 展示 ------------------------> workspaces, teams, tasks, traces, events

 Workspace Runtime (Python ≥3.11，含 adapter 集合的镜像)
-  - 4 个 adapter: Claude Code / Codex / Hermes / OpenClaw
+  - 8 个 adapter: LangGraph / DeepAgents / Claude Code / CrewAI / AutoGen / Hermes / Gemini CLI / OpenClaw
  - Agent Card + A2A server（typed-SSOT 响应路径，RFC #2967）
-  - heartbeat + activity + Memory v2（pgvector 语义召回，per-tenant plugin sidecar）
+  - heartbeat + activity + awareness-backed memory（Memory v2 —— pgvector 语义召回）
  - skills + plugins + hot reload

 SaaS Control Plane (molecule-controlplane，私有)
@@ -317,7 +321,7 @@ npm run dev

 ## 当前范围说明

-当前 `main` 已经包含核心平台、Canvas v4（warm-paper 主题）、Memory v2（pgvector 语义召回）、typed-SSOT A2A 响应路径（RFC #2967）、**4 个维护中的正式 adapter**（Claude Code、Codex、Hermes、OpenClaw）、skill lifecycle，以及主要运维面。
+当前 `main` 已经包含核心平台、Canvas v4（warm-paper 主题）、Memory v2（pgvector 语义召回）、typed-SSOT A2A 响应路径（RFC #2967）、**8 个正式 adapter**（Claude Code、Hermes、Gemini CLI、LangGraph、DeepAgents、CrewAI、AutoGen、OpenClaw）、skill lifecycle，以及主要运维面。

 配套的私有仓库 [`molecule-controlplane`](https://git.moleculesai.app/molecule-ai/molecule-controlplane) 提供 SaaS 层 —— 多租户编排（EC2 + Neon + Cloudflare Tunnels）、KMS 信封加密、WorkOS 鉴权、Stripe 计费，以及 `tenant_resources` 审计表加 30 分钟 reconciler。

@@ -15,11 +15,9 @@ test("FilesTab renders after split", async ({ page, request }) => {
  // Clean slate
  const { workspaces } = await request
    .get("http://localhost:8080/workspaces")
-    .then(async (r) => ({ workspaces: (await r.json()) as Array<{ id: string; name: string }> }));
+    .then(async (r) => ({ workspaces: (await r.json()) as Array<{ id: string }> }));
  for (const w of workspaces) {
-    await request.delete(`http://localhost:8080/workspaces/${w.id}?confirm=true`, {
-      headers: { "X-Confirm-Name": w.name },
-    });
+    await request.delete(`http://localhost:8080/workspaces/${w.id}?confirm=true`);
  }

  // Create a workspace
@@ -82,7 +80,5 @@ test("FilesTab renders after split", async ({ page, request }) => {
  await expect(editorEmpty.first()).toBeVisible({ timeout: 5_000 });

  // Cleanup
-  await request.delete(`http://localhost:8080/workspaces/${wsId}?confirm=true`, {
-    headers: { "X-Confirm-Name": "FilesTab Smoke" },
-  });
+  await request.delete(`http://localhost:8080/workspaces/${wsId}?confirm=true`);
 });
@@ -49,7 +49,7 @@ export async function seedWorkspace(echoURL: string): Promise<SeededWorkspace> {
  };
  let authToken = ws.connection?.auth_token;
  if (!authToken) {
-    authToken = await mintWorkspaceToken(ws.id);
+    authToken = await mintTestToken(ws.id);
  }
  if (!authToken) {
    throw new Error("Workspace created but no auth_token returned");
@@ -202,18 +202,12 @@ export async function cleanupWorkspace(workspaceId: string): Promise<void> {
 * Mint a workspace auth token so the canvas can make authenticated API
 * calls (WorkspaceAuth middleware).
 */
-export async function mintWorkspaceToken(workspaceId: string): Promise<string> {
-  const headers: Record<string, string> = {};
-  const adminToken = process.env.E2E_ADMIN_TOKEN ?? process.env.ADMIN_TOKEN;
-  if (adminToken) {
-    headers.Authorization = `Bearer ${adminToken}`;
-  }
-  const res = await fetch(`${PLATFORM_URL}/admin/workspaces/${workspaceId}/tokens`, {
-    method: "POST",
-    headers,
-  });
+export async function mintTestToken(workspaceId: string): Promise<string> {
+  const res = await fetch(
+    `${PLATFORM_URL}/admin/workspaces/${workspaceId}/test-token`,
+  );
  if (!res.ok) {
-    throw new Error(`Failed to mint workspace token: ${res.status}`);
+    throw new Error(`Failed to mint test token: ${res.status}`);
  }
  const data = (await res.json()) as { auth_token: string };
  return data.auth_token;
@@ -1,35 +0,0 @@
-import { dirname } from "path";
-import { fileURLToPath } from "url";
-import { FlatCompat } from "@eslint/eslintrc";
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
-
-const eslintConfig = [
-  {
-    ignores: [
-      ".next/**",
-      "coverage/**",
-      "out/**",
-      "build/**",
-      "next-env.d.ts",
-    ],
-  },
-  ...compat.extends("next/core-web-vitals", "next/typescript"),
-  {
-    rules: {
-      "@typescript-eslint/no-explicit-any": "warn",
-      "@typescript-eslint/no-require-imports": "warn",
-      "prefer-const": "warn",
-      "react-hooks/rules-of-hooks": "warn",
-      "react/display-name": "warn",
-      "react/no-unescaped-entities": "warn",
-    },
-  },
-];
-
-export default eslintConfig;
@@ -6,12 +6,11 @@
    "dev": "next dev --turbopack -p 3000",
    "build": "next build",
    "start": "next start",
-    "lint": "eslint .",
+    "lint": "next lint",
    "test": "vitest run",
    "test:coverage": "vitest run --coverage"
  },
  "dependencies": {
-    "@novnc/novnc": "^1.7.0",
    "@radix-ui/react-alert-dialog": "^1.1.15",
    "@radix-ui/react-dialog": "^1.1.15",
    "@radix-ui/react-tabs": "^1.1.12",
@@ -31,7 +30,6 @@
  },
  "devDependencies": {
    "@playwright/test": "^1.59.1",
-    "@tailwindcss/postcss": "^4.0.0",
    "@testing-library/jest-dom": "^6.6.0",
    "@testing-library/react": "^16.1.0",
    "@types/node": "^25.6.0",
@@ -39,8 +37,7 @@
    "@types/react-dom": "^19.0.0",
    "@vitejs/plugin-react": "^6.0.1",
    "@vitest/coverage-v8": "^4.1.5",
-    "eslint": "^9.39.4",
-    "eslint-config-next": "^15.5.15",
+    "@tailwindcss/postcss": "^4.0.0",
    "jsdom": "^29.1.1",
    "postcss": "^8.5.13",
    "tailwindcss": "^4.0.0",
@@ -41,12 +41,6 @@ describe("buildCsp — production", () => {
    expect(csp).toContain("object-src 'none'");
  });

-  it("allows blob: in frame-src for authenticated PDF previews", () => {
-    const frameSrc = csp.match(/frame-src[^;]*/)?.[0] ?? "";
-    expect(frameSrc).toContain("'self'");
-    expect(frameSrc).toContain("blob:");
-  });
-
  it("locks base-uri to 'self' (prevents base-tag injection)", () => {
    expect(csp).toContain("base-uri 'self'");
  });
@@ -232,10 +232,7 @@ function CanvasInner() {
    }
    state.beginDelete(subtree);
    try {
-      const workspaceName = state.nodes.find((n) => n.id === id)?.data.name ?? "";
-      await api.del(`/workspaces/${id}?confirm=true`, {
-        headers: { "X-Confirm-Name": workspaceName },
-      });
+      await api.del(`/workspaces/${id}?confirm=true`);
      // Mirror the server-side cascade locally — drop the parent AND
      // every descendant in one atomic update. The per-descendant
      // WORKSPACE_REMOVED WS events still arrive (and are no-ops
@@ -128,7 +128,7 @@ export function ConsoleModal({ workspaceId, workspaceName, open, onClose }: Prop

        <div className="flex-1 overflow-auto bg-black/80 p-4">
          {loading && (
-            <div role="status" aria-live="polite" className="text-[12px] text-ink-mid" data-testid="console-loading">
+            <div className="text-[12px] text-ink-mid" data-testid="console-loading">
              Loading console output…
            </div>
          )}
@@ -5,13 +5,6 @@ import * as Dialog from "@radix-ui/react-dialog";
 import { api } from "@/lib/api";
 import { isSaaSTenant } from "@/lib/tenant";
 import { ExternalConnectModal, type ExternalConnectionInfo } from "./ExternalConnectModal";
-import {
-  ProviderModelSelector,
-  buildProviderCatalog,
-  findProviderForModel,
-  type SelectorModel,
-  type SelectorValue,
-} from "./ProviderModelSelector";

 interface WorkspaceOption {
  id: string;
@@ -29,8 +22,6 @@ interface TemplateSpec {
  id: string;
  name?: string;
  runtime?: string;
-  model?: string;
-  models?: SelectorModel[];
  providers?: string[];
 }

@@ -42,26 +33,7 @@ interface HermesProvider {
  models: string[];
 }

-const DEFAULT_LLM_MODELS: SelectorModel[] = [
-  { id: "moonshot/kimi-k2.6", name: "Kimi K2.6", provider: "platform", required_env: [] },
-  { id: "MiniMax-M2.7", name: "MiniMax M2.7", required_env: ["MINIMAX_API_KEY"] },
-  { id: "kimi-k2-turbo-preview", name: "Kimi K2 Turbo Preview", required_env: ["KIMI_API_KEY"] },
-  { id: "claude-sonnet-4-6", name: "Claude Sonnet 4.6", required_env: ["ANTHROPIC_API_KEY"] },
-  { id: "sonnet", name: "Claude Sonnet", required_env: ["CLAUDE_CODE_OAUTH_TOKEN"] },
-];
-const DEFAULT_PLATFORM_MODEL = DEFAULT_LLM_MODELS[0];
-const DEFAULT_RUNTIME = "claude-code";
-const RUNTIME_OPTIONS = [
-  { value: "claude-code", label: "Claude Code" },
-  { value: "codex", label: "OpenAI Codex CLI" },
-  { value: "hermes", label: "Hermes" },
-  { value: "openclaw", label: "OpenClaw" },
-];
-const BASE_RUNTIME_TEMPLATE_IDS = new Set(["claude-code-default", "codex", "hermes", "openclaw"]);
-const DEFAULT_HEADLESS_INSTANCE_TYPE = "t3.medium";
-const DEFAULT_HEADLESS_ROOT_GB = 30;
-const DEFAULT_DISPLAY_INSTANCE_TYPE = "t3.xlarge";
-const DEFAULT_DISPLAY_ROOT_GB = 80;
+const DEFAULT_CREATE_MODEL = "anthropic:claude-opus-4-7";

 // All providers supported by Hermes runtime via providers.resolve_provider().
 // `defaultModel` is the slug injected into the workspace provision request
@@ -92,7 +64,6 @@ export function CreateWorkspaceButton() {
  const [open, setOpen] = useState(false);
  const [name, setName] = useState("");
  const [role, setRole] = useState("");
-  const [runtime, setRuntime] = useState(DEFAULT_RUNTIME);
  const [template, setTemplate] = useState("");
  const [parentId, setParentId] = useState("");
  const [budgetLimit, setBudgetLimit] = useState("");
@@ -100,8 +71,8 @@ export function CreateWorkspaceButton() {
  const [error, setError] = useState<string | null>(null);
  const [workspaces, setWorkspaces] = useState<WorkspaceOption[]>([]);
  const [displayEnabled, setDisplayEnabled] = useState(false);
-  const [displayInstanceType, setDisplayInstanceType] = useState(DEFAULT_DISPLAY_INSTANCE_TYPE);
-  const [displayRootGB, setDisplayRootGB] = useState(String(DEFAULT_DISPLAY_ROOT_GB));
+  const [displayInstanceType, setDisplayInstanceType] = useState("t3.xlarge");
+  const [displayRootGB, setDisplayRootGB] = useState("80");
  const [displayResolution, setDisplayResolution] = useState("1920x1080");
  // Templates fetched from /api/templates — drives the dynamic provider
  // filter below. Same data source ConfigTab uses (PR #2454). When the
@@ -130,18 +101,11 @@ export function CreateWorkspaceButton() {
  // (Anthropic), which 401s if the user's key is for a different
  // provider. Hence: require model when template=hermes.
  const [hermesModel, setHermesModel] = useState("");
-  const [llmSelection, setLLMSelection] = useState<SelectorValue>({
-    providerId: "platform|",
-    model: "moonshot/kimi-k2.6",
-    envVars: [],
-  });
-  const [llmSecret, setLLMSecret] = useState("");

  // Tier picker: on SaaS every workspace gets its own EC2 VM (Full Access
  // by construction), so we hide the T1/T2/T3 Docker-sandbox tiers and
-  // lock to T4 — the full-host access tier. The EC2 size is controlled by
-  // the compute profile below. On self-hosted we still offer T1/T2/T3
-  // because the Docker-
+  // lock to T4 — the full-host access tier, which maps to t3.large at the
+  // CP level. On self-hosted we still offer T1/T2/T3 because the Docker-
  // sandbox distinction is a real choice there; T4 is available too for
  // operators who want the full-host tier.
  //
@@ -191,72 +155,31 @@ export function CreateWorkspaceButton() {
    []
  );

-  const handleRuntimeChange = useCallback((nextRuntime: string) => {
-    setRuntime(nextRuntime);
-    setTemplate("");
-    setHermesProvider("anthropic");
-    setHermesApiKey("");
-    setHermesModel("");
-    setLLMSelection({ providerId: "platform|", model: DEFAULT_PLATFORM_MODEL.id, envVars: [] });
-    setLLMSecret("");
-  }, []);
+  const isHermes = template.trim().toLowerCase() === "hermes";

-  // Resolve the selected workspace template from /templates. Runtime is
-  // deliberately separate: "SEO Agent" is a workspace template, not a
-  // runtime, so it must never appear in the runtime selector.
+  // Resolve the selected template's spec from the /templates response.
+  // The `template` input is free-text; templates can be matched by id,
+  // name, or runtime so any of those work. Lower-cased compare keeps
+  // "Hermes" / "hermes" / "HERMES" interchangeable.
  const selectedTemplateSpec = useMemo<TemplateSpec | null>(() => {
-    if (!template) return null;
-    return templateSpecs.find((s) => s.id === template) ?? null;
+    const t = template.trim().toLowerCase();
+    if (!t) return null;
+    return (
+      templateSpecs.find(
+        (s) =>
+          (s.id || "").toLowerCase() === t ||
+          (s.name || "").toLowerCase() === t ||
+          (s.runtime || "").toLowerCase() === t,
+      ) ?? null
+    );
  }, [template, templateSpecs]);
-  const selectedRuntimeTemplateSpec = useMemo<TemplateSpec | null>(() => (
-    templateSpecs.find((s) => s.id === runtime && BASE_RUNTIME_TEMPLATE_IDS.has(s.id)) ?? null
-  ), [runtime, templateSpecs]);
-  const isHermes = runtime === "hermes";
-  const visibleTemplateSpecs = useMemo(
-    () => templateSpecs.filter((spec) => {
-      if (BASE_RUNTIME_TEMPLATE_IDS.has(spec.id)) return false;
-      const specRuntime = (spec.runtime ?? DEFAULT_RUNTIME).trim().toLowerCase();
-      return specRuntime === runtime;
-    }),
-    [runtime, templateSpecs],
-  );
-  const llmModels = useMemo(
-    () => {
-      if (!selectedTemplateSpec?.models?.length) return DEFAULT_LLM_MODELS;
-      if (isHermes) {
-        return selectedTemplateSpec.models;
-      }
-      if (selectedTemplateSpec.models.some((model) => model.provider === "platform")) {
-        return selectedTemplateSpec.models;
-      }
-      const templateDefault = selectedTemplateSpec.model?.trim();
-      const defaultModelSpec = templateDefault
-        ? selectedTemplateSpec.models.find((model) => model.id === templateDefault)
-        : undefined;
-      return [
-        {
-          id: templateDefault || DEFAULT_PLATFORM_MODEL.id,
-          name: defaultModelSpec?.name ?? DEFAULT_PLATFORM_MODEL.name,
-          provider: "platform",
-          required_env: [],
-        },
-        ...selectedTemplateSpec.models,
-      ];
-    },
-    [isHermes, selectedTemplateSpec],
-  );
-  const llmCatalog = useMemo(() => buildProviderCatalog(llmModels), [llmModels]);
-  const selectedLLMProvider = useMemo(
-    () => llmCatalog.find((p) => p.id === llmSelection.providerId) ?? llmCatalog[0],
-    [llmCatalog, llmSelection.providerId],
-  );

  // Filter HERMES_PROVIDERS by what the template declares it supports.
  // Empty/missing declared list → fall back to the full catalog so
  // templates that haven't migrated to the explicit `providers:` field
  // (and self-hosted setups without /templates) keep working unchanged.
  const availableProviders = useMemo<HermesProvider[]>(() => {
-    const declared = selectedTemplateSpec?.providers ?? selectedRuntimeTemplateSpec?.providers;
+    const declared = selectedTemplateSpec?.providers;
    if (!declared || declared.length === 0) return HERMES_PROVIDERS;
    const allowed = new Set(declared.map((p) => p.toLowerCase()));
    const filtered = HERMES_PROVIDERS.filter((p) => allowed.has(p.id.toLowerCase()));
@@ -265,7 +188,7 @@ export function CreateWorkspaceButton() {
    // metadata for yet), fall back to the full list rather than render
    // an empty <select>. Better to over-show than to lock the user out.
    return filtered.length > 0 ? filtered : HERMES_PROVIDERS;
-  }, [selectedRuntimeTemplateSpec, selectedTemplateSpec]);
+  }, [selectedTemplateSpec]);

  // If the currently-selected provider is filtered out by a template
  // change, snap back to the first available. Without this, the
@@ -280,23 +203,6 @@ export function CreateWorkspaceButton() {
    // eslint-disable-next-line react-hooks/exhaustive-deps
  }, [availableProviders, isHermes]);

-  useEffect(() => {
-    if (isHermes || llmCatalog.length === 0) return;
-    const templateDefault = selectedTemplateSpec?.model?.trim();
-    const matched = templateDefault ? findProviderForModel(llmCatalog, templateDefault) : null;
-    const next = matched ?? llmCatalog[0];
-    setLLMSelection({
-      providerId: next.id,
-      model: matched && templateDefault
-        ? templateDefault
-        : next.wildcard
-          ? ""
-          : next.models[0]?.id ?? "",
-      envVars: next.envVars,
-    });
-    setLLMSecret("");
-  }, [isHermes, llmCatalog, selectedTemplateSpec?.model]);
-
  // Auto-fill hermesModel with the provider's defaultModel whenever the
  // provider changes, but only if the user hasn't already typed their own
  // slug. Prevents the empty-model → "auto" → Anthropic-default 401 trap.
@@ -319,21 +225,18 @@ export function CreateWorkspaceButton() {
    setName("");
    setRole("");
    setTier(defaultTier);
-    setRuntime(DEFAULT_RUNTIME);
    setTemplate("");
    setParentId("");
    setBudgetLimit("");
    setError(null);
    setDisplayEnabled(false);
-    setDisplayInstanceType(DEFAULT_DISPLAY_INSTANCE_TYPE);
-    setDisplayRootGB(String(DEFAULT_DISPLAY_ROOT_GB));
+    setDisplayInstanceType("t3.xlarge");
+    setDisplayRootGB("80");
    setDisplayResolution("1920x1080");
    setHermesProvider("anthropic");
    setExternalRuntime("external");
    setHermesApiKey("");
    setHermesModel("");
-    setLLMSelection({ providerId: "platform|", model: "moonshot/kimi-k2.6", envVars: [] });
-    setLLMSecret("");
    api
      .get<WorkspaceOption[]>("/workspaces")
      .then((ws) => setWorkspaces(ws))
@@ -360,21 +263,12 @@ export function CreateWorkspaceButton() {
      setError("Model is required for Hermes workspaces — provider routing depends on the model slug prefix");
      return;
    }
-    if (!isExternal && !isHermes && !llmSelection.model.trim()) {
-      setError("Model is required");
-      return;
-    }
-    if (!isExternal && !isHermes && selectedLLMProvider?.envVars.length && !llmSecret.trim()) {
-      setError("Provider credential is required");
-      return;
-    }
    setCreating(true);
    setError(null);

    const provider = isHermes
      ? HERMES_PROVIDERS.find((p) => p.id === hermesProvider)
      : undefined;
-    const nativeProvider = !isHermes ? selectedLLMProvider : undefined;

    try {
      const parsedBudget = budgetLimit.trim()
@@ -398,40 +292,26 @@ export function CreateWorkspaceButton() {
        tier,
        parent_id: parentId || undefined,
        budget_limit: parsedBudget,
-        ...(!isExternal && !isHermes && nativeProvider
+        ...(!isExternal && !isHermes ? { model: DEFAULT_CREATE_MODEL } : {}),
+        ...(displayEnabled
          ? {
-              model: llmSelection.model.trim(),
-              llm_provider: nativeProvider.vendor,
-              ...(nativeProvider.envVars.length > 0
-                ? { secrets: { [nativeProvider.envVars[0]]: llmSecret.trim() } }
-                : {}),
-            }
-          : {}),
-        ...(!isExternal
-          ? {
-              compute: displayEnabled
-                ? {
-                    instance_type: displayInstanceType,
-                    volume: { root_gb: Number.isFinite(parsedRootGB) ? parsedRootGB : DEFAULT_DISPLAY_ROOT_GB },
-                    display: {
-                      mode: "desktop-control",
-                      protocol: "novnc",
-                      width: Number.isFinite(displayWidth) ? displayWidth : 1920,
-                      height: Number.isFinite(displayHeight) ? displayHeight : 1080,
-                    },
-                  }
-                : {
-                    instance_type: DEFAULT_HEADLESS_INSTANCE_TYPE,
-                    volume: { root_gb: DEFAULT_HEADLESS_ROOT_GB },
-                    display: { mode: "none" },
-                  },
+              compute: {
+                instance_type: displayInstanceType,
+                volume: { root_gb: Number.isFinite(parsedRootGB) ? parsedRootGB : 80 },
+                display: {
+                  mode: "desktop-control",
+                  protocol: "novnc",
+                  width: Number.isFinite(displayWidth) ? displayWidth : 1920,
+                  height: Number.isFinite(displayHeight) ? displayHeight : 1080,
+                },
+              },
            }
          : {}),
        canvas: { x: Math.random() * 400 + 100, y: Math.random() * 300 + 100 },
        // Runtime=external flips the backend into awaiting-agent mode:
        // no container provisioning, token minted, connection payload
        // returned in the response for the modal below.
-        ...(isExternal ? { runtime: externalRuntime } : { runtime }),
+        ...(isExternal ? { runtime: externalRuntime } : {}),
        ...(!isExternal && isHermes && provider
          ? {
              secrets: { [provider.envVar]: hermesApiKey.trim() },
@@ -549,76 +429,13 @@ export function CreateWorkspaceButton() {
            )}

            {!isExternal && (
-              <div className="space-y-3">
-                <div>
-                  <label htmlFor="runtime-select" className="text-[11px] text-ink-mid block mb-1">
-                    Runtime
-                  </label>
-                  <select
-                    id="runtime-select"
-                    value={runtime}
-                    onChange={(e) => handleRuntimeChange(e.target.value)}
-                    className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-3 py-2 text-sm text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
-                  >
-                    {RUNTIME_OPTIONS.map((option) => (
-                      <option key={option.value} value={option.value}>
-                        {option.label}
-                      </option>
-                    ))}
-                  </select>
-                </div>
-                <div>
-                  <label htmlFor="workspace-template-select" className="text-[11px] text-ink-mid block mb-1">
-                    Workspace Template
-                  </label>
-                  <select
-                    id="workspace-template-select"
-                    value={template}
-                    onChange={(e) => setTemplate(e.target.value)}
-                    className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-3 py-2 text-sm text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
-                  >
-                    <option value="">Blank workspace</option>
-                    {visibleTemplateSpecs.map((spec) => (
-                      <option key={spec.id} value={spec.id}>
-                        {spec.name || spec.id}
-                      </option>
-                    ))}
-                  </select>
-                </div>
-              </div>
-            )}
-
-            {!isExternal && !isHermes && selectedLLMProvider && (
-              <div className="rounded-lg border border-line/50 bg-surface-card/40 p-3 space-y-3">
-                <div className="text-[11px] font-medium text-ink-mid">
-                  LLM
-                </div>
-                <ProviderModelSelector
-                  models={llmModels}
-                  value={llmSelection}
-                  onChange={(next) => {
-                    setLLMSelection(next);
-                    setLLMSecret("");
-                  }}
-                  idPrefix="create-workspace-llm"
-                  variant="stack"
-                />
-                {selectedLLMProvider.envVars.length > 0 && (
-                  <div>
-                    <label htmlFor="llm-secret-input" className="text-[11px] text-ink-mid block mb-1">
-                      {selectedLLMProvider.envVars[0]}
-                    </label>
-                    <input
-                      id="llm-secret-input"
-                      type="password"
-                      value={llmSecret}
-                      onChange={(e) => setLLMSecret(e.target.value)}
-                      autoComplete="off"
-                      className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-3 py-2 text-sm text-ink placeholder-ink-soft focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors font-mono"
-                    />
-                  </div>
-                )}
-              </div>
+              <InputField
+                label="Template"
+                value={template}
+                onChange={setTemplate}
+                placeholder="e.g. seo-agent (from workspace-configs-templates/)"
+                mono
+              />
            )}

            <div>
@@ -725,11 +542,10 @@ export function CreateWorkspaceButton() {
            )}

            <div>
-              <label htmlFor="parent-workspace-select" className="text-[11px] text-ink-mid block mb-1">
+              <label className="text-[11px] text-ink-mid block mb-1">
                Parent Workspace
              </label>
              <select
-                id="parent-workspace-select"
                value={parentId}
                onChange={(e) => setParentId(e.target.value)}
                className="w-full bg-surface-card/60 border border-line/50 rounded-lg px-3 py-2 text-sm text-ink focus:outline-none focus:border-accent/60 focus:ring-1 focus:ring-accent/20 transition-colors"
@@ -744,7 +560,7 @@ export function CreateWorkspaceButton() {
            </div>
          </div>

-          {/* Hermes provider configuration — shown only for the Hermes runtime. */}
+          {/* Hermes provider configuration — shown only when template === "hermes" */}
          {isHermes && (
            <div
              className="mt-4 rounded-xl border border-violet-700/40 bg-violet-950/20 p-4 space-y-3"
@@ -4,7 +4,7 @@ import { useState, useEffect, useCallback } from "react";
 import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
 import { OrgTemplatesSection } from "./TemplatePalette";
-import { isUserVisibleWorkspaceTemplate, type Template } from "@/lib/deploy-preflight";
+import { type Template } from "@/lib/deploy-preflight";
 import { useTemplateDeploy } from "@/hooks/useTemplateDeploy";
 import { Spinner } from "./Spinner";
 import { TIER_CONFIG } from "@/lib/design-tokens";
@@ -18,7 +18,7 @@ export function EmptyState() {
  useEffect(() => {
    api
      .get<Template[]>("/templates")
-      .then((t) => setTemplates(t.filter(isUserVisibleWorkspaceTemplate)))
+      .then((t) => setTemplates(t))
      .catch(() => setTemplates([]))
      .finally(() => setLoading(false));
  }, []);
@@ -24,10 +24,9 @@
 * "no memories yet".
 */

-import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { useCallback, useEffect, useMemo, useState } from 'react';
 import { api } from '@/lib/api';
 import { ConfirmDialog } from '@/components/ConfirmDialog';
-import { useSocketEvent } from '@/hooks/useSocketEvent';

 // ── Types ─────────────────────────────────────────────────────────────────────

@@ -247,60 +246,6 @@ export function MemoryInspectorPanel({ workspaceId }: Props) {
    loadEntries();
  }, [loadEntries]);

-  // Live-refresh on ACTIVITY_LOGGED events that look like memory writes
-  // for this workspace (#1734). Without this, the user sees a stale
-  // empty state after an agent commits — agent says "wrote memory",
-  // panel keeps showing nothing until they hit Refresh.
-  //
-  // What actually broadcasts ACTIVITY_LOGGED on the server today
-  // (workspace-server/internal/handlers/activity.go LogActivity /
-  // LogActivityTx — those are the only emitters):
-  //
-  //   - `memory_write_global`  — `POST /workspaces/:id/memories` for GLOBAL scope
-  //   - `memory_edit_global`   — `PATCH /workspaces/:id/memories/:id` for GLOBAL scope
-  //   - `memory_delete_global` — `DELETE /workspaces/:id/memories/:id` for GLOBAL scope
-  //   - `agent_log`            — generic catch-all an agent emits via
-  //                              `POST /workspaces/:id/activity`
-  //
-  // The MCP-tool path (`commit_memory`, `commit_memory_v2`,
-  // `commit_summary`) does NOT broadcast on the wire today; it inserts
-  // into agent_memories (pre-A1) or calls the v2 plugin (post-A1) and
-  // never round-trips through LogActivity. Server-side follow-up is
-  // tracked in **#1754** — once the MCP handlers emit `memory_write`
-  // via LogActivity, the `agent_log` arm of the filter below can be
-  // dropped. `memory_write` is included pre-emptively so this code
-  // lights up the moment #1754 lands. Until then, `agent_log` catches
-  // MCP commits over-inclusively; the 300ms debounce bounds the
-  // refetch rate. Issue #1734 review finding.
-  //
-  // The 300ms debounce coalesces bursts so a chatty agent (e.g. an
-  // agent in a long task emitting agent_log every few hundred ms)
-  // doesn't hammer /v2/memories on every keystroke-equivalent.
-  const refetchTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
-  useEffect(() => () => {
-    if (refetchTimerRef.current) clearTimeout(refetchTimerRef.current);
-  }, []);
-  useSocketEvent((msg) => {
-    if (msg.event !== 'ACTIVITY_LOGGED') return;
-    if (msg.workspace_id !== workspaceId) return;
-    const p = (msg.payload || {}) as Record<string, unknown>;
-    const activityType = (p.activity_type as string) || '';
-    switch (activityType) {
-      case 'memory_write':
-      case 'memory_write_global':
-      case 'memory_edit_global':
-      case 'memory_delete_global':
-      case 'agent_log':
-        break;
-      default:
-        return;
-    }
-    if (refetchTimerRef.current) clearTimeout(refetchTimerRef.current);
-    refetchTimerRef.current = setTimeout(() => {
-      loadEntries();
-    }, 300);
-  });
-
  // ── Delete handlers ─────────────────────────────────────────────────────────

  const confirmDelete = useCallback(async () => {
@@ -23,8 +23,6 @@ interface Props {
  /** Grouped provider options derived from the template's models[] /
   *  required_env. When length ≥ 2 the modal shows a radio picker. */
  providers?: ProviderChoice[];
-  /** Optional keys to offer in the deploy modal without blocking Deploy. */
-  optionalKeys?: string[];
  /** Runtime slug — used only for the "The <runtime> runtime …"
   *  headline; behavior is driven by providers/missingKeys. */
  runtime: string;
@@ -96,13 +94,13 @@ export function MissingKeysModal({
  open,
  missingKeys,
  providers,
-  optionalKeys,
  runtime,
  onKeysAdded,
  onCancel,
  onOpenSettings,
  workspaceId,
  configuredKeys,
+  modelSuggestions,
  models,
  initialModel,
  title,
@@ -116,13 +114,13 @@ export function MissingKeysModal({
      <ProviderPickerModal
        open={open}
        providers={pickerProviders}
-        optionalKeys={optionalKeys ?? []}
        runtime={runtime}
        onKeysAdded={onKeysAdded}
        onCancel={onCancel}
        onOpenSettings={onOpenSettings}
        workspaceId={workspaceId}
        configuredKeys={configuredKeys}
+        modelSuggestions={modelSuggestions}
        models={models}
        initialModel={initialModel}
        title={title}
@@ -140,15 +138,11 @@ export function MissingKeysModal({
    <AllKeysModal
      open={open}
      missingKeys={keys}
-      optionalKeys={optionalKeys ?? []}
      runtime={runtime}
      onKeysAdded={onKeysAdded}
      onCancel={onCancel}
      onOpenSettings={onOpenSettings}
      workspaceId={workspaceId}
-      configuredKeys={configuredKeys}
-      title={title}
-      description={description}
    />
  );
 }
@@ -176,13 +170,13 @@ export function providerIdForModel(
 function ProviderPickerModal({
  open,
  providers,
-  optionalKeys,
  runtime,
  onKeysAdded,
  onCancel,
  onOpenSettings,
  workspaceId,
  configuredKeys,
+  modelSuggestions,
  models,
  initialModel,
  title,
@@ -190,13 +184,13 @@ function ProviderPickerModal({
 }: {
  open: boolean;
  providers: ProviderChoice[];
-  optionalKeys: string[];
  runtime: string;
  onKeysAdded: (model?: string) => void;
  onCancel: () => void;
  onOpenSettings?: () => void;
  workspaceId?: string;
  configuredKeys?: Set<string>;
+  modelSuggestions?: string[];
  models?: ModelSpec[];
  initialModel?: string;
  title?: string;
@@ -256,9 +250,16 @@ function ProviderPickerModal({

  const [selectorValue, setSelectorValue] = useState<SelectorValue>(initial);
  const [entries, setEntries] = useState<KeyEntry[]>([]);
-  const [optionalEntries, setOptionalEntries] = useState<KeyEntry[]>([]);
  const firstInputRef = useRef<HTMLInputElement>(null);

+  // Legacy compat: map the selector value back into the old `selected`/
+  // `model` shape for the rest of the modal body (footer copy, etc.).
+  const selected = useMemo(
+    () =>
+      providers.find((p) => p.id === selectorValue.providerId) ??
+      providers[0],
+    [providers, selectorValue.providerId],
+  );
  const model = selectorValue.model;
  const showModelInput = catalog.length > 0;

@@ -281,18 +282,7 @@ function ProviderPickerModal({
        error: null,
      })),
    );
-    setOptionalEntries(
-      optionalKeys
-        .filter((key) => !selectorValue.envVars.includes(key))
-        .map((key) => ({
-          key,
-          value: "",
-          saved: configuredKeys?.has(key) ?? false,
-          saving: false,
-          error: null,
-        })),
-    );
-  }, [open, selectorValue.envVars, configuredKeys, optionalKeys]);
+  }, [open, selectorValue.envVars, configuredKeys]);

  useEffect(() => {
    if (!open) return;
@@ -346,43 +336,6 @@ function ProviderPickerModal({
    [entries, updateEntry, workspaceId],
  );

-  const updateOptionalEntry = useCallback(
-    (index: number, updates: Partial<KeyEntry>) => {
-      setOptionalEntries((prev) =>
-        prev.map((e, i) => (i === index ? { ...e, ...updates } : e)),
-      );
-    },
-    [],
-  );
-
-  const handleSaveOptionalKey = useCallback(
-    async (index: number) => {
-      const entry = optionalEntries[index];
-      if (!entry.value.trim()) return;
-      updateOptionalEntry(index, { saving: true, error: null });
-      try {
-        if (workspaceId) {
-          await api.put(`/workspaces/${workspaceId}/secrets`, {
-            key: entry.key,
-            value: entry.value.trim(),
-          });
-        } else {
-          await api.put("/settings/secrets", {
-            key: entry.key,
-            value: entry.value.trim(),
-          });
-        }
-        updateOptionalEntry(index, { saved: true, saving: false });
-      } catch (e) {
-        updateOptionalEntry(index, {
-          saving: false,
-          error: e instanceof Error ? e.message : "Failed to save",
-        });
-      }
-    },
-    [optionalEntries, updateOptionalEntry, workspaceId],
-  );
-
  if (!open) return null;
  // Portal to document.body for the same reason as
  // OrgImportPreflightModal — several callers (TemplatePalette,
@@ -512,62 +465,6 @@ function ProviderPickerModal({
              </div>
            ))}
          </div>
-
-          {optionalEntries.length > 0 && (
-            <div className="space-y-2">
-              <div className="text-[10px] uppercase tracking-wide text-ink-mid font-semibold">
-                Optional
-              </div>
-              {optionalEntries.map((entry, index) => (
-                <div
-                  key={entry.key}
-                  className="bg-surface-card/30 rounded-lg px-3 py-2.5 border border-line/40"
-                >
-                  <div className="flex items-center justify-between mb-1.5">
-                    <div>
-                      <div className="text-[11px] text-ink-mid font-medium">
-                        {getKeyLabel(entry.key)}
-                      </div>
-                      <div className="text-[9px] font-mono text-ink-mid">{entry.key}</div>
-                    </div>
-                    {entry.saved && (
-                      <span className="text-[9px] text-good bg-emerald-900/30 px-1.5 py-0.5 rounded flex items-center gap-1">
-                        Saved
-                      </span>
-                    )}
-                  </div>
-                  {!entry.saved && (
-                    <div className="flex gap-2 mt-2">
-                      <input
-                        value={entry.value}
-                        onChange={(e) => updateOptionalEntry(index, { value: e.target.value.trimStart() })}
-                        placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
-                        type="password"
-                        aria-label={`Optional value for ${entry.key}`}
-                        onKeyDown={(e) => {
-                          if (e.key === "Enter" && entry.value.trim()) {
-                            handleSaveOptionalKey(index);
-                          }
-                        }}
-                        className="flex-1 bg-surface-sunken border border-line rounded px-2 py-1.5 text-[11px] text-ink font-mono focus:outline-none focus:border-accent focus:ring-1 focus:ring-accent/20 transition-colors"
-                      />
-                      <button
-                        type="button"
-                        onClick={() => handleSaveOptionalKey(index)}
-                        disabled={!entry.value.trim() || entry.saving}
-                        className="px-3 py-1.5 bg-surface-card hover:bg-surface-card/80 text-[11px] rounded text-ink border border-line disabled:opacity-30 transition-colors shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
-                      >
-                        {entry.saving ? "..." : "Save"}
-                      </button>
-                    </div>
-                  )}
-                  {entry.error && (
-                    <div role="alert" aria-live="assertive" className="mt-1.5 text-[10px] text-bad">{entry.error}</div>
-                  )}
-                </div>
-              ))}
-            </div>
-          )}
        </div>

        <div className="px-5 py-3 border-t border-line bg-surface/50 flex items-center justify-between gap-2">
@@ -615,30 +512,21 @@ function ProviderPickerModal({
 function AllKeysModal({
  open,
  missingKeys,
-  optionalKeys,
  runtime,
  onKeysAdded,
  onCancel,
  onOpenSettings,
  workspaceId,
-  configuredKeys,
-  title,
-  description,
 }: {
  open: boolean;
  missingKeys: string[];
-  optionalKeys: string[];
  runtime: string;
  onKeysAdded: () => void;
  onCancel: () => void;
  onOpenSettings?: () => void;
  workspaceId?: string;
-  configuredKeys?: Set<string>;
-  title?: string;
-  description?: string;
 }) {
  const [entries, setEntries] = useState<KeyEntry[]>([]);
-  const [optionalEntries, setOptionalEntries] = useState<KeyEntry[]>([]);
  const [globalError, setGlobalError] = useState<string | null>(null);

  useEffect(() => {
@@ -647,24 +535,13 @@ function AllKeysModal({
      missingKeys.map((key) => ({
        key,
        value: "",
-        saved: configuredKeys?.has(key) ?? false,
+        saved: false,
        saving: false,
        error: null,
      })),
    );
-    setOptionalEntries(
-      optionalKeys
-        .filter((key) => !missingKeys.includes(key))
-        .map((key) => ({
-          key,
-          value: "",
-          saved: configuredKeys?.has(key) ?? false,
-          saving: false,
-          error: null,
-        })),
-    );
    setGlobalError(null);
-  }, [open, missingKeys, optionalKeys, configuredKeys]);
+  }, [open, missingKeys]);

  useEffect(() => {
    if (!open) return;
@@ -714,45 +591,6 @@ function AllKeysModal({
    [entries, updateEntry, workspaceId],
  );

-  const updateOptionalEntry = useCallback(
-    (index: number, updates: Partial<KeyEntry>) => {
-      setOptionalEntries((prev) =>
-        prev.map((entry, i) => (i === index ? { ...entry, ...updates } : entry)),
-      );
-    },
-    [],
-  );
-
-  const handleSaveOptionalKey = useCallback(
-    async (index: number) => {
-      const entry = optionalEntries[index];
-      if (!entry.value.trim()) return;
-
-      updateOptionalEntry(index, { saving: true, error: null });
-
-      try {
-        if (workspaceId) {
-          await api.put(`/workspaces/${workspaceId}/secrets`, {
-            key: entry.key,
-            value: entry.value.trim(),
-          });
-        } else {
-          await api.put("/settings/secrets", {
-            key: entry.key,
-            value: entry.value.trim(),
-          });
-        }
-        updateOptionalEntry(index, { saved: true, saving: false });
-      } catch (e) {
-        updateOptionalEntry(index, {
-          saving: false,
-          error: e instanceof Error ? e.message : "Failed to save",
-        });
-      }
-    },
-    [optionalEntries, updateOptionalEntry, workspaceId],
-  );
-
  const handleAddKeysAndDeploy = useCallback(() => {
    const anySaving = entries.some((e) => e.saving);
    if (anySaving) {
@@ -818,16 +656,12 @@ function AllKeysModal({
              </svg>
            </div>
            <h3 id="missing-keys-title" className="text-sm font-semibold text-ink">
-              {title ?? "Missing API Keys"}
+              Missing API Keys
            </h3>
          </div>
          <p className="text-[12px] text-ink-mid leading-relaxed">
-            {description ?? (
-              <>
-                The <span className="text-warm font-medium">{runtimeLabel}</span>{" "}
-                runtime requires the following keys to be configured before deploying.
-              </>
-            )}
+            The <span className="text-warm font-medium">{runtimeLabel}</span>{" "}
+            runtime requires the following keys to be configured before deploying.
          </p>
        </div>

@@ -885,62 +719,6 @@ function AllKeysModal({
            </div>
          ))}

-          {optionalEntries.length > 0 && (
-            <div className="space-y-2">
-              <div className="text-[10px] uppercase tracking-wide text-ink-mid font-semibold">
-                Optional
-              </div>
-              {optionalEntries.map((entry, index) => (
-                <div
-                  key={entry.key}
-                  className="bg-surface-card/30 rounded-lg px-3 py-2.5 border border-line/40"
-                >
-                  <div className="flex items-center justify-between mb-1">
-                    <div>
-                      <div className="text-[11px] text-ink-mid font-medium">
-                        {getKeyLabel(entry.key)}
-                      </div>
-                      <div className="text-[9px] font-mono text-ink-mid">{entry.key}</div>
-                    </div>
-                    {entry.saved && (
-                      <span className="text-[9px] text-good bg-emerald-900/30 px-1.5 py-0.5 rounded">
-                        Saved
-                      </span>
-                    )}
-                  </div>
-
-                  {!entry.saved && (
-                    <div className="flex gap-2 mt-2">
-                      <input
-                        value={entry.value}
-                        onChange={(e) => updateOptionalEntry(index, { value: e.target.value.trimStart() })}
-                        placeholder={entry.key.includes("API_KEY") ? "sk-..." : "Enter value"}
-                        type="password"
-                        aria-label={`Optional value for ${entry.key}`}
-                        onKeyDown={(e) => {
-                          if (e.key === "Enter" && entry.value.trim()) {
-                            handleSaveOptionalKey(index);
-                          }
-                        }}
-                        className="flex-1 bg-surface-sunken border border-line rounded px-2 py-1.5 text-[11px] text-ink font-mono focus:outline-none focus:border-accent focus:ring-1 focus:ring-accent/20 transition-colors"
-                      />
-                      <button
-                        type="button"
-                        onClick={() => handleSaveOptionalKey(index)}
-                        disabled={!entry.value.trim() || entry.saving}
-                        className="px-3 py-1.5 bg-surface-card hover:bg-surface-card/80 text-[11px] rounded text-ink border border-line disabled:opacity-30 transition-colors shrink-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
-                      >
-                        {entry.saving ? "..." : "Save"}
-                      </button>
-                    </div>
-                  )}
-
-                  {entry.error && <div className="mt-1.5 text-[10px] text-bad">{entry.error}</div>}
-                </div>
-              ))}
-            </div>
-          )}
-
          {globalError && (
            <div role="alert" aria-live="assertive" className="px-3 py-2 bg-red-950/40 border border-red-800/50 rounded-lg text-[11px] text-bad">
              {globalError}
@@ -28,7 +28,6 @@ import { useId, useMemo } from "react";
 export interface SelectorModel {
  id: string;
  name?: string;
-  provider?: string;
  required_env?: string[];
 }

@@ -89,7 +88,6 @@ interface Props {
 /** Vendor keys → human label. Add new vendors here when templates pick
 *  up new model families. */
 const VENDOR_LABELS: Record<string, string> = {
-  "platform": "Platform",
  "anthropic-oauth": "Claude Code subscription",
  anthropic: "Anthropic API",
  minimax: "MiniMax",
@@ -120,8 +118,6 @@ const VENDOR_LABELS: Record<string, string> = {

 /** Optional per-vendor tooltip shown on hover. */
 const VENDOR_TOOLTIPS: Record<string, string> = {
-  "platform":
-    "Use the Molecule platform-managed LLM proxy. No vendor API key is required.",
  "anthropic-oauth":
    "Use your Claude.ai (Pro/Max/Team) subscription via OAuth. Run `claude login` in the workspace terminal to mint the token, then paste it here. No API spend.",
  anthropic:
@@ -169,9 +165,6 @@ const BARE_VENDOR_PATTERNS: Array<{ test: (id: string) => boolean; vendor: strin
 /** Infer a vendor key from a model spec. Combines id-prefix and env
 *  signals. Exported for tests. */
 export function inferVendor(model: SelectorModel): string {
-  const explicitProvider = model.provider?.trim().toLowerCase();
-  if (explicitProvider) return explicitProvider;
-
  const id = model.id || "";
  const envSet = new Set(model.required_env ?? []);

@@ -242,13 +242,10 @@ export function ProvisioningTimeout({
  const handleCancelConfirm = useCallback(async () => {
    if (!confirmingCancel) return;
    const workspaceId = confirmingCancel;
-    const workspaceName = timedOut.find((e) => e.workspaceId === workspaceId)?.workspaceName ?? "";
    setConfirmingCancel(null);
    setCancelling((prev) => new Set(prev).add(workspaceId));
    try {
-      await api.del(`/workspaces/${workspaceId}`, {
-        headers: { "X-Confirm-Name": workspaceName },
-      });
+      await api.del(`/workspaces/${workspaceId}`);
      setTimedOut((prev) => prev.filter((e) => e.workspaceId !== workspaceId));
      trackingRef.current.delete(workspaceId);
      showToast("Deployment cancelled", "info");
@@ -305,9 +305,7 @@ export function SidePanel() {
        {panelTab === "chat" && <ChatTab key={selectedNodeId} workspaceId={selectedNodeId} data={node.data} />}
        {panelTab === "terminal" && <TerminalTab key={selectedNodeId} workspaceId={selectedNodeId} data={node.data} />}
        {panelTab === "display" && <DisplayTab key={selectedNodeId} workspaceId={selectedNodeId} />}
-        {panelTab === "container-config" && selectedNodeId && (
-          <ContainerConfigTab key={selectedNodeId} workspaceId={selectedNodeId} data={node.data} />
-        )}
+        {panelTab === "container-config" && <ContainerConfigTab key={selectedNodeId} data={node.data} />}
        {panelTab === "config" && <ConfigTab key={selectedNodeId} workspaceId={selectedNodeId} />}
        {panelTab === "schedule" && <ScheduleTab key={selectedNodeId} workspaceId={selectedNodeId} />}
        {panelTab === "channels" && <ChannelsTab key={selectedNodeId} workspaceId={selectedNodeId} />}
@@ -5,7 +5,7 @@ import { flushSync } from "react-dom";
 import { api } from "@/lib/api";
 import { useCanvasStore } from "@/store/canvas";
 import type { WorkspaceData } from "@/store/socket";
-import { isUserVisibleWorkspaceTemplate, type Template } from "@/lib/deploy-preflight";
+import { type Template } from "@/lib/deploy-preflight";
 import { useTemplateDeploy } from "@/hooks/useTemplateDeploy";
 import {
  OrgImportPreflightModal,
@@ -446,7 +446,7 @@ export function TemplatePalette() {
    setLoading(true);
    try {
      const data = await api.get<Template[]>("/templates");
-      setTemplates(data.filter(isUserVisibleWorkspaceTemplate));
+      setTemplates(data);
    } catch {
      setTemplates([]);
    } finally {
@@ -20,34 +20,10 @@ const SAMPLE_WORKSPACES = [
  { id: "ws-2", name: "Research Agent", tier: 2 },
 ];

-const SAMPLE_TEMPLATES = [
-  {
-    id: "seo-agent",
-    name: "SEO Agent",
-    runtime: "claude-code",
-    model: "moonshot/kimi-k2.6",
-    providers: ["platform", "minimax", "kimi-coding", "anthropic", "anthropic-oauth"],
-    models: [
-      { id: "moonshot/kimi-k2.6", name: "Kimi K2.6", provider: "platform", required_env: [] },
-      { id: "MiniMax-M2.7", name: "MiniMax M2.7", required_env: ["MINIMAX_API_KEY"] },
-      { id: "kimi-k2-turbo-preview", name: "Kimi K2 Turbo Preview", required_env: ["KIMI_API_KEY"] },
-      { id: "claude-sonnet-4-6", name: "Claude Sonnet 4.6", required_env: ["ANTHROPIC_API_KEY"] },
-      { id: "sonnet", name: "Claude Sonnet", required_env: ["CLAUDE_CODE_OAUTH_TOKEN"] },
-    ],
-  },
-  { id: "hermes", name: "Hermes", runtime: "hermes" },
-];
-
 beforeEach(() => {
  vi.clearAllMocks();
-  mockGet.mockImplementation(async (url: string) => {
-    if (url === "/templates") {
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      return SAMPLE_TEMPLATES as any;
-    }
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    return SAMPLE_WORKSPACES as any;
-  });
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  mockGet.mockResolvedValue(SAMPLE_WORKSPACES as any);
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
  mockPost.mockResolvedValue({} as any);
 });
@@ -66,14 +42,7 @@ async function openDialog() {

 async function setTemplate(value: string) {
  fireEvent.change(
-    screen.getByLabelText("Workspace Template"),
-    { target: { value } }
-  );
-}
-
-async function setRuntime(value: string) {
-  fireEvent.change(
-    screen.getByLabelText("Runtime"),
+    screen.getByPlaceholderText("e.g. seo-agent (from workspace-configs-templates/)"),
    { target: { value } }
  );
 }
@@ -94,7 +63,7 @@ describe("CreateWorkspaceDialog", () => {

  it('first option is "None (root level)" with empty value', async () => {
    await openDialog();
-    const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+    const select = document.querySelector("select") as HTMLSelectElement;
    expect(select).toBeTruthy();
    const firstOption = select.options[0];
    expect(firstOption.value).toBe("");
@@ -104,12 +73,12 @@ describe("CreateWorkspaceDialog", () => {
  it("populates select with workspace names from GET /workspaces", async () => {
    await openDialog();
    await waitFor(() => {
-      const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+      const select = document.querySelector("select") as HTMLSelectElement;
      const optionValues = Array.from(select.options).map((o) => o.value);
      expect(optionValues).toContain("ws-1");
      expect(optionValues).toContain("ws-2");
    });
-    const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+    const select = document.querySelector("select") as HTMLSelectElement;
    const optionTexts = Array.from(select.options).map((o) => o.text.trim());
    expect(optionTexts.some((t) => t.includes("Platform Team"))).toBe(true);
    expect(optionTexts.some((t) => t.includes("Research Agent"))).toBe(true);
@@ -118,7 +87,7 @@ describe("CreateWorkspaceDialog", () => {
  it("sends parent_id in POST body when a workspace is selected", async () => {
    await openDialog();
    await waitFor(() => {
-      const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+      const select = document.querySelector("select") as HTMLSelectElement;
      expect(select.options.length).toBeGreaterThan(1);
    });

@@ -126,7 +95,7 @@ describe("CreateWorkspaceDialog", () => {
      target: { value: "My Agent" },
    });

-    const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+    const select = document.querySelector("select") as HTMLSelectElement;
    fireEvent.change(select, { target: { value: "ws-1" } });

    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
@@ -143,7 +112,7 @@ describe("CreateWorkspaceDialog", () => {
      target: { value: "Root Agent" },
    });

-    const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+    const select = document.querySelector("select") as HTMLSelectElement;
    fireEvent.change(select, { target: { value: "" } });

    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
@@ -154,7 +123,7 @@ describe("CreateWorkspaceDialog", () => {
    expect(body.parent_id).toBeUndefined();
  });

-  it("sends the cost-efficient headless compute profile by default", async () => {
+  it("omits compute config by default", async () => {
    await openDialog();
    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
      target: { value: "Plain Agent" },
@@ -163,54 +132,10 @@ describe("CreateWorkspaceDialog", () => {
    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
    fireEvent.click(createBtn!);

-    await waitFor(() => expect(mockPost).toHaveBeenCalled());
-    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.compute).toEqual({
-      instance_type: "t3.medium",
-      volume: { root_gb: 30 },
-      display: { mode: "none" },
-    });
-    expect(body.model).toBe("moonshot/kimi-k2.6");
-    expect(body.llm_provider).toBe("platform");
-    expect(body.runtime).toBe("claude-code");
-    expect(body.secrets).toBeUndefined();
-  });
-
-  it("keeps runtime and workspace template as separate selectors", async () => {
-    await openDialog();
-
-    const runtimeSelect = screen.getByLabelText("Runtime") as HTMLSelectElement;
-    const runtimeTexts = Array.from(runtimeSelect.options).map((o) => o.text.trim());
-    expect(runtimeTexts).toEqual([
-      "Claude Code",
-      "OpenAI Codex CLI",
-      "Hermes",
-      "OpenClaw",
-    ]);
-    expect(runtimeTexts).not.toContain("SEO Agent");
-
-    await waitFor(() => {
-      const templateSelect = screen.getByLabelText("Workspace Template") as HTMLSelectElement;
-      const templateTexts = Array.from(templateSelect.options).map((o) => o.text.trim());
-      expect(templateTexts).toContain("SEO Agent");
-      expect(templateTexts).not.toContain("Hermes");
-    });
-  });
-
-  it("does not send managed compute for external agents", async () => {
-    await openDialog();
-    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
-      target: { value: "External Agent" },
-    });
-    fireEvent.click(screen.getByLabelText(/External agent/));
-
-    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
-    fireEvent.click(createBtn!);
-
    await waitFor(() => expect(mockPost).toHaveBeenCalled());
    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
    expect(body.compute).toBeUndefined();
-    expect(body.runtime).toBe("external");
+    expect(body.model).toBe("anthropic:claude-opus-4-7");
  });

  it("sends display compute profile when desktop display is enabled", async () => {
@@ -225,8 +150,7 @@ describe("CreateWorkspaceDialog", () => {

    await waitFor(() => expect(mockPost).toHaveBeenCalled());
    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.model).toBe("moonshot/kimi-k2.6");
-    expect(body.llm_provider).toBe("platform");
+    expect(body.model).toBe("anthropic:claude-opus-4-7");
    expect(body.compute).toEqual({
      instance_type: "t3.xlarge",
      volume: { root_gb: 80 },
@@ -239,57 +163,13 @@ describe("CreateWorkspaceDialog", () => {
    });
  });

-  it("sends BYOK API key secrets when API key auth mode is selected", async () => {
-    await openDialog();
-    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
-      target: { value: "BYOK Agent" },
-    });
-    fireEvent.change(document.querySelector("[data-testid='provider-select']") as HTMLSelectElement, {
-      target: { value: "minimax|MINIMAX_API_KEY" },
-    });
-    fireEvent.change(document.getElementById("llm-secret-input") as HTMLInputElement, {
-      target: { value: "sk-minimax-test" },
-    });
-
-    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
-    fireEvent.click(createBtn!);
-
-    await waitFor(() => expect(mockPost).toHaveBeenCalled());
-    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.model).toBe("MiniMax-M2.7");
-    expect(body.llm_provider).toBe("minimax");
-    expect(body.secrets).toEqual({ MINIMAX_API_KEY: "sk-minimax-test" });
-  });
-
-  it("sends Claude OAuth token separately from platform-managed mode", async () => {
-    await openDialog();
-    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
-      target: { value: "OAuth Agent" },
-    });
-    fireEvent.change(document.querySelector("[data-testid='provider-select']") as HTMLSelectElement, {
-      target: { value: "anthropic-oauth|CLAUDE_CODE_OAUTH_TOKEN" },
-    });
-    fireEvent.change(document.getElementById("llm-secret-input") as HTMLInputElement, {
-      target: { value: "oauth-token" },
-    });
-
-    const createBtn = screen.getAllByRole("button").find((b) => b.textContent === "Create");
-    fireEvent.click(createBtn!);
-
-    await waitFor(() => expect(mockPost).toHaveBeenCalled());
-    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
-    expect(body.model).toBe("sonnet");
-    expect(body.llm_provider).toBe("anthropic-oauth");
-    expect(body.secrets).toEqual({ CLAUDE_CODE_OAUTH_TOKEN: "oauth-token" });
-  });
-
  it("renders gracefully when GET /workspaces fails", async () => {
    mockGet.mockRejectedValueOnce(new Error("Network error"));
    await openDialog();

    // Dialog still renders; select exists with only the root option
    await waitFor(() => {
-      const select = screen.getByLabelText("Parent Workspace") as HTMLSelectElement;
+      const select = document.querySelector("select") as HTMLSelectElement;
      expect(select.options.length).toBe(1);
      expect(select.options[0].value).toBe("");
    });
@@ -307,17 +187,17 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeNull();
  });

-  it("shows hermes provider section when runtime is 'hermes'", async () => {
+  it("shows hermes provider section when template is 'hermes'", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
  });

-  it("shows hermes provider section for the Hermes runtime preset", async () => {
+  it("shows hermes provider section for template 'HERMES' (case-insensitive)", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("HERMES");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -325,7 +205,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {

  it("hermes provider dropdown defaults to 'anthropic'", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -336,7 +216,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {

  it("hermes provider dropdown lists all 15 providers", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -370,7 +250,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    });

    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -400,7 +280,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    });

    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -426,7 +306,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    });

    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -437,7 +317,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {

  it("hermes API key field is a password input (masked)", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -451,7 +331,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
      target: { value: "Hermes Agent" },
    });
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -472,7 +352,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
      target: { value: "Hermes Agent" },
    });
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -487,8 +367,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    await waitFor(() => expect(mockPost).toHaveBeenCalled());
    const body = mockPost.mock.calls[0][1] as Record<string, unknown>;
    expect(body.secrets).toEqual({ ANTHROPIC_API_KEY: "sk-test-anthropic-key" });
-    expect(body.runtime).toBe("hermes");
-    expect(body.template).toBeUndefined();
+    expect(body.template).toBe("hermes");
  });

  it("uses the correct env var when a non-default provider is selected", async () => {
@@ -496,7 +375,7 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {
    fireEvent.change(screen.getByPlaceholderText("e.g. SEO Agent"), {
      target: { value: "Hermes OpenAI" },
    });
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );
@@ -533,13 +412,13 @@ describe("CreateWorkspaceDialog — Hermes provider picker", () => {

  it("hides hermes section and resets state when template is cleared", async () => {
    await openDialog();
-    await setRuntime("hermes");
+    await setTemplate("hermes");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeTruthy()
    );

-    // Switch back to a non-Hermes runtime.
-    await setRuntime("claude-code");
+    // Clear template
+    await setTemplate("");
    await waitFor(() =>
      expect(document.querySelector("[data-testid='hermes-provider-section']")).toBeNull()
    );
@@ -16,7 +16,7 @@
 *   - handleDeployed fires after 500ms delay
 *
 * Uses vi.hoisted + vi.mock to fully isolate the api module, matching
- * the pattern established in ApprovalBanner and ScheduleTab tests.
+ * the pattern established in ApprovalBanner, MemoryTab, and ScheduleTab tests.
 */
 import React from "react";
 import { render, screen, fireEvent, cleanup, act } from "@testing-library/react";
@@ -96,12 +96,12 @@ vi.mock("@/lib/design-tokens", () => ({
 // ─── Fixtures ─────────────────────────────────────────────────────────────────

 const TEMPLATE = {
-  id: "seo-agent",
-  name: "SEO Agent",
-  description: "SEO workspace template",
+  id: "tpl-1",
+  name: "Claude Code Agent",
+  description: "A general-purpose coding assistant",
  tier: 2,
  skill_count: 3,
-  model: "MiniMax-M2.7",
+  model: "claude-opus-4-5",
 };

 function template(overrides: Partial<typeof TEMPLATE> = {}): typeof TEMPLATE {
@@ -159,7 +159,7 @@ describe("EmptyState — loading", () => {
  it("does not render template buttons while loading", async () => {
    renderEmpty();
    await flush();
-    expect(screen.queryByText("SEO Agent")).toBeNull();
+    expect(screen.queryByText("Claude Code Agent")).toBeNull();
  });
 });

@@ -183,8 +183,8 @@ describe("EmptyState — templates", () => {
  it("renders template buttons with name and description", async () => {
    renderEmpty();
    await flush();
-    expect(screen.getByText("SEO Agent")).toBeTruthy();
-    expect(screen.getByText("SEO workspace template")).toBeTruthy();
+    expect(screen.getByText("Claude Code Agent")).toBeTruthy();
+    expect(screen.getByText("A general-purpose coding assistant")).toBeTruthy();
  });

  it("renders tier badge and skill count", async () => {
@@ -198,42 +198,25 @@ describe("EmptyState — templates", () => {
  it("renders model name when present", async () => {
    renderEmpty();
    await flush();
-    expect(screen.getByText(/MiniMax-M2.7/i)).toBeTruthy();
+    expect(screen.getByText(/claude-opus/i)).toBeTruthy();
  });

  it("calls deploy with the template on click", async () => {
    renderEmpty();
    await flush();
-    fireEvent.click(screen.getByText("SEO Agent"));
+    fireEvent.click(screen.getByText("Claude Code Agent"));
    expect(_deploy.deployFn).toHaveBeenCalledWith(template());
  });

-  it("hides runtime-default templates from the product template grid", async () => {
-    mockApiGet.mockResolvedValue([
-      template({ id: "claude-code-default", name: "Claude Code Agent" }),
-      template({ id: "codex", name: "OpenAI Codex CLI" }),
-      template({ id: "hermes", name: "Hermes Agent" }),
-      template({ id: "openclaw", name: "OpenClaw Agent" }),
-      template(),
-    ]);
-    renderEmpty();
-    await flush();
-    expect(screen.getByText("SEO Agent")).toBeTruthy();
-    expect(screen.queryByText("Claude Code Agent")).toBeNull();
-    expect(screen.queryByText("OpenAI Codex CLI")).toBeNull();
-    expect(screen.queryByText("Hermes Agent")).toBeNull();
-    expect(screen.queryByText("OpenClaw Agent")).toBeNull();
-  });
-
  it("shows 'Deploying...' on the button of the template being deployed", async () => {
-    _deploy.deploying = "seo-agent";
+    _deploy.deploying = "tpl-1";
    renderEmpty();
    await flush();
    expect(screen.getByText("Deploying...")).toBeTruthy();
  });

  it("disables the template button of the deploying template", async () => {
-    _deploy.deploying = "seo-agent";
+    _deploy.deploying = "tpl-1";
    renderEmpty();
    await flush();
    const btn = screen.getByText("Deploying...").closest("button") as HTMLButtonElement;
@@ -241,7 +224,7 @@ describe("EmptyState — templates", () => {
  });

  it("disables 'create blank' while a template is deploying", async () => {
-    _deploy.deploying = "seo-agent";
+    _deploy.deploying = "tpl-1";
    renderEmpty();
    await flush();
    expect(screen.getByRole("button", { name: "+ Create blank workspace" }).disabled).toBe(true);
@@ -262,7 +245,7 @@ describe("EmptyState — fetch failure / empty templates", () => {
  it("does not render template grid when GET /templates returns []", async () => {
    renderEmpty();
    await flush();
-    expect(screen.queryByText("SEO Agent")).toBeNull();
+    expect(screen.queryByText("Claude Code Agent")).toBeNull();
  });

  it("renders 'create blank' button when templates list is empty", async () => {
@@ -275,7 +258,7 @@ describe("EmptyState — fetch failure / empty templates", () => {
    mockApiGet.mockReset().mockRejectedValue(new Error("Network failure"));
    renderEmpty();
    await flush();
-    expect(screen.queryByText("SEO Agent")).toBeNull();
+    expect(screen.queryByText("Claude Code Agent")).toBeNull();
  });
 });

@@ -333,7 +316,7 @@ describe("EmptyState — create blank", () => {
    await flush();
    fireEvent.click(screen.getByRole("button", { name: "+ Create blank workspace" }));
    await act(async () => { await Promise.resolve(); });
-    expect((screen.getByText("SEO Agent").closest("button") as HTMLButtonElement).disabled).toBe(true);
+    expect((screen.getByText("Claude Code Agent").closest("button") as HTMLButtonElement).disabled).toBe(true);
  });

  it("shows error banner when POST /workspaces fails", async () => {
@@ -0,0 +1,93 @@
+// @vitest-environment jsdom
+/**
+ * Unit tests for pure helpers from MemoryInspectorPanel:
+ *   isPluginUnavailableError, formatRelativeTime, formatTTL
+ *
+ * These are the three exported non-component functions. The component
+ * itself (MemoryInspectorPanel) requires full API + store mocking and
+ * is exercised by the existing MemoryTab.test.tsx.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { isPluginUnavailableError, formatTTL } from "../MemoryInspectorPanel";
+
+// formatRelativeTime is not exported — tested via the component in MemoryTab.test.tsx
+
+describe("isPluginUnavailableError", () => {
+  it("returns true when Error message contains MEMORY_PLUGIN_URL", () => {
+    const err = new Error("memory: could not resolve MEMORY_PLUGIN_URL — plugin not configured");
+    expect(isPluginUnavailableError(err)).toBe(true);
+  });
+
+  it("returns true for Error containing MEMORY_PLUGIN_URL", () => {
+    expect(isPluginUnavailableError(new Error("MEMORY_PLUGIN_URL is not set"))).toBe(true);
+  });
+
+  it("returns false for unrelated error messages", () => {
+    expect(isPluginUnavailableError(new Error("workspace not found"))).toBe(false);
+  });
+
+  it("returns false for null", () => {
+    expect(isPluginUnavailableError(null)).toBe(false);
+  });
+
+  it("returns false for undefined", () => {
+    expect(isPluginUnavailableError(undefined)).toBe(false);
+  });
+
+  it("returns false for plain objects without message", () => {
+    expect(isPluginUnavailableError({ code: 503 })).toBe(false);
+  });
+
+  it("is case-sensitive (MEMORY_PLUGIN_URL must match exactly)", () => {
+    const lowerErr = new Error("memory_plugin_url missing");
+    const upperErr = new Error("MEMORY_PLUGIN_URL missing");
+    expect(isPluginUnavailableError(lowerErr)).toBe(false);
+    expect(isPluginUnavailableError(upperErr)).toBe(true);
+  });
+});
+
+describe("formatTTL", () => {
+  beforeEach(() => { vi.useFakeTimers(); });
+  afterEach(() => { vi.useRealTimers(); });
+
+  it("returns '' for null", () => {
+    expect(formatTTL(null)).toBe("");
+  });
+
+  it("returns '' for undefined", () => {
+    expect(formatTTL(undefined)).toBe("");
+  });
+
+  it('returns "expired" when expiresAt is in the past', () => {
+    const past = new Date(Date.now() - 60_000).toISOString();
+    expect(formatTTL(past)).toBe("expired");
+  });
+
+  it('returns "Xs" for less than a minute', () => {
+    const soon = new Date(Date.now() + 30_000).toISOString();
+    expect(formatTTL(soon)).toBe("30s");
+  });
+
+  it('returns "Xm" for less than an hour', () => {
+    const soon = new Date(Date.now() + 5 * 60_000).toISOString();
+    expect(formatTTL(soon)).toBe("5m");
+  });
+
+  it('returns "Xh" for less than a day', () => {
+    const soon = new Date(Date.now() + 3 * 3_600_000).toISOString();
+    expect(formatTTL(soon)).toBe("3h");
+  });
+
+  it('returns "Xd" for more than a day', () => {
+    const soon = new Date(Date.now() + 2 * 86_400_000).toISOString();
+    expect(formatTTL(soon)).toBe("2d");
+  });
+
+  it("returns '' for invalid date string", () => {
+    expect(formatTTL("not-a-date")).toBe("");
+  });
+
+  it("returns '' for empty string", () => {
+    expect(formatTTL("")).toBe("");
+  });
+});
@@ -31,17 +31,6 @@ vi.mock('@/lib/api', () => ({
  },
 }));

-// Capture the socket-event handler the panel registers so individual
-// tests can replay an ACTIVITY_LOGGED message without spinning up a
-// real WebSocket. One handler at a time is fine — the panel mounts
-// exactly one useSocketEvent subscriber.
-let __socketHandler: ((msg: unknown) => void) | null = null;
-vi.mock('@/hooks/useSocketEvent', () => ({
-  useSocketEvent: (handler: (msg: unknown) => void) => {
-    __socketHandler = handler;
-  },
-}));
-
 vi.mock('@/components/ConfirmDialog', () => ({
  ConfirmDialog: ({
    open,
@@ -527,156 +516,3 @@ describe('MemoryInspectorPanel — refresh', () => {
    });
  });
 });
-
-// Live-refresh subscription wired in #1734 so the panel reacts to
-// ACTIVITY_LOGGED events for memory writes on this workspace without
-// the user clicking Refresh. The hook is mocked at the top of the
-// file to capture the registered handler in __socketHandler.
-describe('MemoryInspectorPanel — live refresh on activity', () => {
-  it('refetches memories when ACTIVITY_LOGGED arrives with activity_type=memory_write for the same workspace', async () => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    stubFetch([MEM_BASIC]);
-    render(<MemoryInspectorPanel workspaceId="ws-1" />);
-    await waitFor(() => screen.getByLabelText('Refresh memories'));
-    expect(__socketHandler).toBeTruthy();
-
-    const before = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-
-    __socketHandler!({
-      event: 'ACTIVITY_LOGGED',
-      workspace_id: 'ws-1',
-      payload: { activity_type: 'memory_write' },
-    });
-
-    // 300ms debounce inside the panel — advance the fake timer so the
-    // queued refetch fires.
-    await vi.advanceTimersByTimeAsync(350);
-
-    await waitFor(() => {
-      const after = mockGet.mock.calls.filter((c) =>
-        (c[0] as string).includes('/v2/memories'),
-      ).length;
-      expect(after).toBe(before + 1);
-    });
-    vi.useRealTimers();
-  });
-
-  it('ignores ACTIVITY_LOGGED events from other workspaces', async () => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    stubFetch([MEM_BASIC]);
-    render(<MemoryInspectorPanel workspaceId="ws-1" />);
-    await waitFor(() => screen.getByLabelText('Refresh memories'));
-
-    const before = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-
-    __socketHandler!({
-      event: 'ACTIVITY_LOGGED',
-      workspace_id: 'ws-OTHER',
-      payload: { activity_type: 'memory_write' },
-    });
-
-    await vi.advanceTimersByTimeAsync(500);
-
-    const after = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-    expect(after).toBe(before);
-    vi.useRealTimers();
-  });
-
-  it('ignores activity types that are not memory-related', async () => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    stubFetch([MEM_BASIC]);
-    render(<MemoryInspectorPanel workspaceId="ws-1" />);
-    await waitFor(() => screen.getByLabelText('Refresh memories'));
-
-    const before = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-
-    __socketHandler!({
-      event: 'ACTIVITY_LOGGED',
-      workspace_id: 'ws-1',
-      payload: { activity_type: 'a2a_send' },
-    });
-
-    await vi.advanceTimersByTimeAsync(500);
-
-    const after = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-    expect(after).toBe(before);
-    vi.useRealTimers();
-  });
-
-  // Server-side emitters confirmed via grep of workspace-server/internal/handlers
-  // are `memory_write_global`, `memory_edit_global`, `memory_delete_global`
-  // (memories.go `LogActivity` calls for GLOBAL-scope writes). Pin each
-  // so a future filter narrow-down can't silently drop one and let the
-  // panel go stale on its actual production trigger.
-  it.each([
-    'memory_write',          // pre-emptive: not yet emitted by server, see component comment
-    'memory_write_global',   // memories.go:218 (Commit)
-    'memory_edit_global',    // memories.go:617 (Update)
-    'memory_delete_global',  // memories.go (Delete) — paired with the above two
-    'agent_log',             // generic catch-all
-  ])('refetches on activity_type=%s', async (activityType) => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    stubFetch([MEM_BASIC]);
-    render(<MemoryInspectorPanel workspaceId="ws-1" />);
-    await waitFor(() => screen.getByLabelText('Refresh memories'));
-
-    const before = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-
-    __socketHandler!({
-      event: 'ACTIVITY_LOGGED',
-      workspace_id: 'ws-1',
-      payload: { activity_type: activityType },
-    });
-
-    await vi.advanceTimersByTimeAsync(350);
-
-    await waitFor(() => {
-      const after = mockGet.mock.calls.filter((c) =>
-        (c[0] as string).includes('/v2/memories'),
-      ).length;
-      expect(after).toBe(before + 1);
-    });
-    vi.useRealTimers();
-  });
-
-  it('coalesces a burst of memory_write events into one refetch', async () => {
-    vi.useFakeTimers({ shouldAdvanceTime: true });
-    stubFetch([MEM_BASIC]);
-    render(<MemoryInspectorPanel workspaceId="ws-1" />);
-    await waitFor(() => screen.getByLabelText('Refresh memories'));
-
-    const before = mockGet.mock.calls.filter((c) =>
-      (c[0] as string).includes('/v2/memories'),
-    ).length;
-
-    for (let i = 0; i < 5; i++) {
-      __socketHandler!({
-        event: 'ACTIVITY_LOGGED',
-        workspace_id: 'ws-1',
-        payload: { activity_type: 'memory_write' },
-      });
-    }
-
-    await vi.advanceTimersByTimeAsync(350);
-
-    await waitFor(() => {
-      const after = mockGet.mock.calls.filter((c) =>
-        (c[0] as string).includes('/v2/memories'),
-      ).length;
-      expect(after).toBe(before + 1);
-    });
-    vi.useRealTimers();
-  });
-});
@@ -402,31 +402,6 @@ describe("MissingKeysModal — add keys and deploy", () => {
    expect(onKeysAdded).toHaveBeenCalled();
  });

-  it("shows optional keys without blocking deploy", () => {
-    const onKeysAdded = vi.fn();
-    render(
-      <MissingKeysModal
-        open={true}
-        missingKeys={[]}
-        optionalKeys={["GOOGLE_GSC_SITE"]}
-        runtime="claude-code"
-        title="Configure Workspace"
-        onKeysAdded={onKeysAdded}
-        onCancel={vi.fn()}
-      />
-    );
-
-    expect(screen.getByText("Optional")).toBeTruthy();
-    expect(screen.getAllByText("GOOGLE_GSC_SITE").length).toBeGreaterThan(0);
-    const deployBtn = Array.from(document.querySelectorAll("button")).find(
-      (b) => b.textContent?.trim() === "Deploy",
-    );
-    expect(deployBtn).toBeTruthy();
-    expect(deployBtn!.disabled).toBe(false);
-    act(() => { fireEvent.click(deployBtn!); });
-    expect(onKeysAdded).toHaveBeenCalled();
-  });
-
  it("shows global error when not all keys saved", async () => {
    const onKeysAdded = vi.fn();
    render(
@@ -554,4 +529,4 @@ describe("MissingKeysModal — cancel and settings", () => {
    );
    expect(screen.queryByRole("button", { name: /open settings/i })).toBeNull();
  });
-});
+});
@@ -272,9 +272,7 @@ describe("OrgCancelButton — API interactions", () => {
    fireEvent.click(screen.getByRole("button", { name: /cancel deployment of test org/i }));
    fireEvent.click(screen.getByRole("button", { name: /yes/i }));
    await act(async () => { /* flush */ });
-    expect(mockApiDel).toHaveBeenCalledWith("/workspaces/root-1?confirm=true", {
-      headers: { "X-Confirm-Name": "Test Org" },
-    });
+    expect(mockApiDel).toHaveBeenCalledWith("/workspaces/root-1?confirm=true");
  });

  it("shows success toast on DELETE success", async () => {
@@ -44,14 +44,6 @@ const HERMES_MODELS: SelectorModel[] = [
 ];

 describe("inferVendor", () => {
-  it("uses explicit provider metadata before slug heuristics", () => {
-    expect(inferVendor({
-      id: "moonshot/kimi-k2.6",
-      provider: "platform",
-      required_env: [],
-    })).toBe("platform");
-  });
-
  it("uses slash prefix when present", () => {
    expect(inferVendor({ id: "nousresearch/hermes-4-70b", required_env: ["HERMES_API_KEY"] }))
      .toBe("nousresearch");
@@ -113,22 +105,6 @@ describe("buildProviderCatalog", () => {
    expect(oauth!.models.map((m) => m.id).sort()).toEqual(["haiku", "opus", "sonnet"]);
  });

-  it("labels explicit platform-managed providers", () => {
-    const catalog = buildProviderCatalog([
-      {
-        id: "moonshot/kimi-k2.6",
-        name: "Kimi K2.6",
-        provider: "platform",
-        required_env: [],
-      },
-    ]);
-    expect(catalog[0]).toMatchObject({
-      vendor: "platform",
-      label: "Platform",
-      envVars: [],
-    });
-  });
-
  it("flags wildcard providers", () => {
    const catalog = buildProviderCatalog(HERMES_MODELS);
    const hf = catalog.find((p) => p.vendor === "huggingface");
@@ -189,23 +189,6 @@ describe("TemplatePalette — sidebar", () => {
    expect(screen.getByText("Researcher")).toBeTruthy();
  });

-  it("hides runtime-default templates from the deployable product template list", async () => {
-    mockGet.mockResolvedValue([
-      { id: "claude-code-default", name: "Claude Code Agent", description: "", tier: 4, skills: [] },
-      { id: "codex", name: "OpenAI Codex CLI", description: "", tier: 4, skills: [] },
-      { id: "hermes", name: "Hermes Agent", description: "", tier: 4, skills: [] },
-      { id: "openclaw", name: "OpenClaw Agent", description: "", tier: 4, skills: [] },
-      { id: "seo-agent", name: "SEO Agent", description: "SEO workspace template", tier: 4, skills: ["seo"] },
-    ]);
-    render(<TemplatePalette />);
-    await openSidebar();
-    expect(screen.getByText("SEO Agent")).toBeTruthy();
-    expect(screen.queryByText("Claude Code Agent")).toBeNull();
-    expect(screen.queryByText("OpenAI Codex CLI")).toBeNull();
-    expect(screen.queryByText("Hermes Agent")).toBeNull();
-    expect(screen.queryByText("OpenClaw Agent")).toBeNull();
-  });
-
  it("shows template description", async () => {
    mockGet.mockResolvedValue(MOCK_TEMPLATES);
    render(<TemplatePalette />);
@@ -57,7 +57,6 @@ export function OrgCancelButton({ rootId, rootName, workspaceCount }: Props) {
    try {
      await api.del<{ status: string }>(
        `/workspaces/${rootId}?confirm=true`,
-        { headers: { "X-Confirm-Name": rootName } },
      );
      showToast(`Cancelled deployment of "${rootName}"`, "success");
      // Optimistic local removal — workspace-server broadcasts
@@ -199,9 +199,7 @@ describe("OrgCancelButton — Yes / cascade delete", () => {
    });

    // 1) API call hit the cascade-delete endpoint with confirm=true
-    expect(mockApiDel).toHaveBeenCalledWith("/workspaces/ws-root?confirm=true", {
-      headers: { "X-Confirm-Name": "My Org" },
-    });
+    expect(mockApiDel).toHaveBeenCalledWith("/workspaces/ws-root?confirm=true");

    // 2) beginDelete locked the WHOLE subtree (root + 2 children) — NOT the unrelated node
    expect(mockState.beginDelete).toHaveBeenCalledTimes(1);
@@ -369,7 +369,7 @@ export function ChannelsTab({ workspaceId }: Props) {
            onClick={handleCreate}
            // Was bg-accent-strong hover:bg-accent — accent is the
            // LIGHTER variant; same AA contrast trap fixed in
-            // ScheduleTab/OnboardingWizard.
+            // ScheduleTab/MemoryTab/OnboardingWizard.
            className="w-full text-xs py-1.5 rounded bg-accent hover:bg-accent-strong text-white transition focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-2 focus-visible:ring-offset-surface"
          >
            Connect Channel
@@ -253,7 +253,7 @@ interface RuntimeOption {
  // its config.yaml under runtime_config.providers. The /templates API
  // surfaces it (workspace-server templates.go) so canvas stays
  // adapter-driven: hermes ships ~20 slugs, claude-code ships
-  // ["anthropic"], codex ships OpenAI-compatible model ids, etc. Empty list →
+  // ["anthropic"], gemini-cli ships ["gemini"], etc. Empty list →
  // canvas falls back to deriving unique vendor prefixes from
  // models[].id (still adapter-driven, just inferred).
  providers: string[];
@@ -301,13 +301,16 @@ export function deriveProvidersFromModels(models: ModelSpec[]): string[] {
 // config.yaml` on the container is a separate runtime-internal file,
 // not this one.
 const RUNTIMES_WITH_OWN_CONFIG = new Set<string>(["external", "kimi", "kimi-cli", "openclaw"]);
-const SUPPORTED_RUNTIME_VALUES = new Set(["claude-code", "codex", "openclaw", "hermes"]);

 const FALLBACK_RUNTIME_OPTIONS: RuntimeOption[] = [
+  { value: "", label: "LangGraph (default)", models: [], providers: [] },
  { value: "claude-code", label: "Claude Code", models: [], providers: [] },
-  { value: "codex", label: "Codex", models: [], providers: [] },
+  { value: "crewai", label: "CrewAI", models: [], providers: [] },
+  { value: "autogen", label: "AutoGen", models: [], providers: [] },
+  { value: "deepagents", label: "DeepAgents", models: [], providers: [] },
  { value: "openclaw", label: "OpenClaw", models: [], providers: [] },
  { value: "hermes", label: "Hermes", models: [], providers: [] },
+  { value: "gemini-cli", label: "Gemini CLI", models: [], providers: [] },
 ];

 export function ConfigTab({ workspaceId }: Props) {
@@ -496,9 +499,10 @@ export function ConfigTab({ workspaceId }: Props) {
      .then((rows) => {
        if (cancelled || !Array.isArray(rows)) return;
        const byRuntime = new Map<string, RuntimeOption>();
+        byRuntime.set("", { value: "", label: "LangGraph (default)", models: [], providers: [] });
        for (const r of rows) {
          const v = (r.runtime || "").trim();
-          if (!SUPPORTED_RUNTIME_VALUES.has(v)) continue;
+          if (!v || v === "langgraph") continue;
          // Last template wins if two templates share a runtime — rare, and the
          // one with the richer models list is probably newer.
          const existing = byRuntime.get(v);
@@ -508,7 +512,7 @@ export function ConfigTab({ workspaceId }: Props) {
            byRuntime.set(v, { value: v, label: r.name || v, models, providers });
          }
        }
-        if (byRuntime.size > 0) setRuntimeOptions(Array.from(byRuntime.values()));
+        if (byRuntime.size > 1) setRuntimeOptions(Array.from(byRuntime.values()));
      })
      .catch(() => { /* keep fallback */ });
    return () => { cancelled = true; };
@@ -1,210 +1,46 @@
 "use client";

-import { useEffect, useMemo, useState } from "react";
-import { api } from "@/lib/api";
 import { runtimeDisplayName } from "@/lib/runtime-names";
-import { useCanvasStore, type WorkspaceNodeData } from "@/store/canvas";
-import type { WorkspaceCompute } from "@/store/socket";
-
-const INSTANCE_TYPES = ["t3.medium", "t3.large", "t3.xlarge", "t3.2xlarge", "m6i.large", "m6i.xlarge", "c6i.xlarge"];
-const RUNTIME_OPTIONS = ["claude-code", "codex", "hermes", "openclaw", "kimi", "kimi-cli", "external"];
-const RESOLUTIONS = ["1280x720", "1440x900", "1920x1080", "2560x1440"];
-const DEFAULT_HEADLESS_INSTANCE_TYPE = "t3.medium";
-const DEFAULT_HEADLESS_ROOT_GB = 30;
+import type { WorkspaceNodeData } from "@/store/canvas";

 type Props = {
-  workspaceId: string;
  data: Pick<
    WorkspaceNodeData,
    "runtime" | "status" | "needsRestart" | "activeTasks" | "deliveryMode"
-    | "workspaceAccess" | "maxConcurrentTasks" | "compute" | "applyTemplateOnRestart"
+    | "workspaceAccess" | "maxConcurrentTasks"
  >;
 };

-type FormState = {
-  runtime: string;
-  instanceType: string;
-  rootGB: string;
-  displayEnabled: boolean;
-  displayMode: string;
-  displayProtocol: string;
-  resolution: string;
-};
-
-export function ContainerConfigTab({ workspaceId, data }: Props) {
-  const runtime = data.runtime;
-  const instanceType = data.compute?.instance_type;
-  const rootGB = data.compute?.volume?.root_gb;
-  const displayMode = data.compute?.display?.mode;
-  const displayProtocol = data.compute?.display?.protocol;
-  const displayWidth = data.compute?.display?.width;
-  const displayHeight = data.compute?.display?.height;
-  const initial = useMemo(
-    () => formFromData({ runtime, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight }),
-    [runtime, instanceType, rootGB, displayMode, displayProtocol, displayWidth, displayHeight],
-  );
-  const [form, setForm] = useState<FormState>(initial);
-  const [saving, setSaving] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [success, setSuccess] = useState(false);
-
-  useEffect(() => {
-    setForm(initial);
-    setError(null);
-    setSuccess(false);
-  }, [initial]);
-
+export function ContainerConfigTab({ data }: Props) {
+  const runtime = data.runtime || "unknown";
  const workspaceAccess = formatAccess(data.workspaceAccess);
  const maxConcurrentTasks = data.maxConcurrentTasks ? String(data.maxConcurrentTasks) : "platform-managed";
+  const mountedPath = "/workspace";
+  const privilegeStatus = "standard";
  const deliveryMode = data.deliveryMode || "push";
-  const dirty = JSON.stringify(form) !== JSON.stringify(initial);
-  const restartLabel = dirty ? "Save & Restart" : "Restart to apply";
-  const resolutionOptions = RESOLUTIONS.includes(form.resolution)
-    ? RESOLUTIONS
-    : [form.resolution, ...RESOLUTIONS];
-
-  const save = async (restart: boolean) => {
-    setError(null);
-    setSuccess(false);
-
-    setSaving(true);
-    try {
-      let applyTemplateOnRestart = data.applyTemplateOnRestart ?? false;
-      if (dirty) {
-        const rootGB = parseInt(form.rootGB, 10);
-        if (!Number.isFinite(rootGB)) {
-          setError("Root volume must be a number");
-          return;
-        }
-
-        const [width, height] = form.resolution.split("x").map((v) => parseInt(v, 10));
-        const compute: WorkspaceCompute = {
-          instance_type: form.instanceType,
-          volume: { root_gb: rootGB },
-          display: form.displayEnabled
-            ? { mode: form.displayMode, protocol: form.displayProtocol, width, height }
-            : { mode: "none" },
-        };
-
-        const resp = await api.patch<{ needs_restart?: boolean }>(`/workspaces/${workspaceId}`, {
-          runtime: form.runtime,
-          compute,
-        });
-        useCanvasStore.getState().updateNodeData(workspaceId, {
-          runtime: form.runtime,
-          compute,
-          needsRestart: resp.needs_restart ?? true,
-          applyTemplateOnRestart: form.runtime !== initial.runtime,
-        });
-        applyTemplateOnRestart = form.runtime !== initial.runtime;
-      }
-
-      if (restart) {
-        await useCanvasStore.getState().restartWorkspace(workspaceId, {
-          applyTemplate: applyTemplateOnRestart,
-        });
-      }
-      setSuccess(true);
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Failed to save");
-    } finally {
-      setSaving(false);
-    }
-  };

  return (
    <div className="p-4 space-y-4">
      <section className="rounded-lg border border-line/50 bg-surface-card/40 p-4">
-        <div className="mb-3 flex items-center justify-between gap-3">
+        <div className="mb-3">
          <h3 className="text-sm font-semibold text-ink">Container Config</h3>
-          {data.needsRestart && <span className="text-[11px] text-warm">Restart required</span>}
        </div>

-        <div className="grid grid-cols-1 gap-3 text-[11px]">
-          <SelectField
-            id="runtime-image-profile"
-            label="Runtime image"
-            value={form.runtime}
-            options={RUNTIME_OPTIONS}
-            optionLabel={runtimeDisplayName}
-            onChange={(runtime) => setForm((s) => ({ ...s, runtime }))}
-          />
-          <SelectField
-            id="instance-type"
-            label="Instance type"
-            value={form.instanceType}
-            options={INSTANCE_TYPES}
-            onChange={(instanceType) => setForm((s) => ({ ...s, instanceType }))}
-          />
-          <label className="grid gap-1" htmlFor="root-volume-gb">
-            <span className="text-ink-mid">Root volume</span>
-            <div className="flex items-center gap-2">
-              <input
-                id="root-volume-gb"
-                aria-label="Root volume"
-                type="number"
-                min={30}
-                max={500}
-                value={form.rootGB}
-                onChange={(e) => setForm((s) => ({ ...s, rootGB: e.target.value }))}
-                className="min-w-0 flex-1 rounded-md border border-line/60 bg-surface-sunken px-3 py-2 font-mono text-ink outline-none focus:border-accent"
-              />
-              <span className="text-ink-mid">GB</span>
-            </div>
-          </label>
-          <label className="flex items-center justify-between gap-3 rounded-md bg-surface-sunken/40 px-3 py-2">
-            <span className="text-ink-mid">Display</span>
-            <input
-              type="checkbox"
-              aria-label="Enable display"
-              checked={form.displayEnabled}
-              onChange={(e) => setForm((s) => ({
-                ...s,
-                displayEnabled: e.target.checked,
-                displayMode: e.target.checked && s.displayMode === "none" ? "desktop-control" : s.displayMode,
-                displayProtocol: e.target.checked && !s.displayProtocol ? "novnc" : s.displayProtocol,
-              }))}
-              className="h-4 w-4 accent-accent"
-            />
-          </label>
-          {form.displayEnabled && (
-            <SelectField
-              id="display-resolution"
-              label="Resolution"
-              value={form.resolution}
-              options={resolutionOptions}
-              onChange={(resolution) => setForm((s) => ({ ...s, resolution }))}
-            />
-          )}
-        </div>
+        <dl className="grid grid-cols-1 gap-2 text-[11px]">
+          <ConfigRow label="Runtime image" value={runtimeDisplayName(runtime)} detail={runtime} />
+          <ConfigRow label="Workspace access" value={workspaceAccess} />
+          <ConfigRow label="Max concurrent tasks" value={maxConcurrentTasks} />
+          <ConfigRow label="Mounted workspace path" value={mountedPath} />
+          <ConfigRow label="Container privileges" value={privilegeStatus} />
+          <ConfigRow label="Delivery mode" value={deliveryMode} />
+        </dl>
+      </section>

-        <div className="mt-4 flex items-center justify-end gap-2">
-          {error && <span className="mr-auto text-[11px] text-bad">{error}</span>}
-          {success && <span className="mr-auto text-[11px] text-good">Saved</span>}
-          <button
-            type="button"
-            disabled={!dirty || saving}
-            onClick={() => setForm(initial)}
-            className="rounded-md border border-line/60 px-3 py-2 text-[11px] text-ink-mid disabled:cursor-not-allowed disabled:opacity-50"
-          >
-            Reset
-          </button>
-          <button
-            type="button"
-            disabled={!dirty || saving}
-            onClick={() => save(false)}
-            className="rounded-md bg-accent px-3 py-2 text-[11px] font-medium text-white disabled:cursor-not-allowed disabled:opacity-50"
-          >
-            {saving ? "Saving..." : "Save"}
-          </button>
-          <button
-            type="button"
-            disabled={(!dirty && !data.needsRestart) || saving}
-            onClick={() => save(true)}
-            className="rounded-md bg-ink px-3 py-2 text-[11px] font-medium text-surface disabled:cursor-not-allowed disabled:opacity-50"
-          >
-            {saving ? "Restarting..." : restartLabel}
-          </button>
+      <section className="rounded-lg border border-line/50 bg-surface-card/40 p-4">
+        <h3 className="mb-3 text-sm font-semibold text-ink">Session Controls</h3>
+        <div className="grid grid-cols-2 gap-2">
+          <ReadOnlyAction label={data.needsRestart ? "Restart required" : "Restart"} />
+          <ReadOnlyAction label="Reset session" />
        </div>
      </section>

@@ -213,73 +49,13 @@ export function ContainerConfigTab({ workspaceId, data }: Props) {
        <dl className="grid grid-cols-1 gap-2 text-[11px]">
          <ConfigRow label="Container status" value={data.status} />
          <ConfigRow label="Active tasks" value={String(data.activeTasks ?? 0)} />
-          <ConfigRow label="Workspace access" value={workspaceAccess} />
-          <ConfigRow label="Max concurrent tasks" value={maxConcurrentTasks} />
-          <ConfigRow label="Mounted workspace path" value="/workspace" />
-          <ConfigRow label="Delivery mode" value={deliveryMode} />
+          <ConfigRow label="Mounted path access" value="available" />
        </dl>
      </section>
    </div>
  );
 }

-function formFromData(data: {
-  runtime?: string;
-  instanceType?: string;
-  rootGB?: number;
-  displayMode?: string;
-  displayProtocol?: string;
-  displayWidth?: number;
-  displayHeight?: number;
-}): FormState {
-  const width = data.displayWidth ?? 1920;
-  const height = data.displayHeight ?? 1080;
-  const resolution = `${width}x${height}`;
-  return {
-    runtime: data.runtime || "claude-code",
-    instanceType: data.instanceType || DEFAULT_HEADLESS_INSTANCE_TYPE,
-    rootGB: String(data.rootGB || DEFAULT_HEADLESS_ROOT_GB),
-    displayEnabled: !!data.displayMode && data.displayMode !== "none",
-    displayMode: data.displayMode && data.displayMode !== "none" ? data.displayMode : "desktop-control",
-    displayProtocol: data.displayProtocol || "novnc",
-    resolution,
-  };
-}
-
-function SelectField({
-  id,
-  label,
-  value,
-  options,
-  optionLabel = (v: string) => v,
-  onChange,
-}: {
-  id: string;
-  label: string;
-  value: string;
-  options: string[];
-  optionLabel?: (value: string) => string;
-  onChange: (value: string) => void;
-}) {
-  return (
-    <label className="grid gap-1" htmlFor={id}>
-      <span className="text-ink-mid">{label}</span>
-      <select
-        id={id}
-        value={value}
-        onChange={(e) => onChange(e.target.value)}
-        className="rounded-md border border-line/60 bg-surface-sunken px-3 py-2 font-mono text-ink outline-none focus:border-accent"
-      >
-        {options.map((option) => (
-          <option key={option} value={option}>
-            {optionLabel(option)}
-          </option>
-        ))}
-      </select>
-    </label>
-  );
-}
-
 function formatAccess(value: string | null | undefined): string {
  if (!value) return "none";
  return value.replace(/_/g, "-");
@@ -288,16 +64,33 @@ function formatAccess(value: string | null | undefined): string {
 function ConfigRow({
  label,
  value,
+  detail,
 }: {
  label: string;
  value: string;
+  detail?: string;
 }) {
  return (
    <div className="flex items-start justify-between gap-3 rounded-md bg-surface-sunken/40 px-3 py-2">
      <dt className="text-ink-mid">{label}</dt>
      <dd className="min-w-0 text-right">
        <div className="font-mono text-ink break-words">{value}</div>
+        {detail && detail !== value && (
+          <div className="mt-0.5 font-mono text-[10px] text-ink-mid break-words">{detail}</div>
+        )}
      </dd>
    </div>
  );
 }
+
+function ReadOnlyAction({ label }: { label: string }) {
+  return (
+    <button
+      type="button"
+      disabled
+      className="rounded-md border border-line/50 bg-surface-sunken/40 px-3 py-2 text-[11px] text-ink-mid disabled:cursor-not-allowed disabled:opacity-70"
+    >
+      {label}
+    </button>
+  );
+}
@@ -93,9 +93,7 @@ export function DetailsTab({ workspaceId, data }: Props) {
  const handleDelete = async () => {
    setDeleteError(null);
    try {
-      await api.del(`/workspaces/${workspaceId}?confirm=true`, {
-        headers: { "X-Confirm-Name": name },
-      });
+      await api.del(`/workspaces/${workspaceId}?confirm=true`);
      // Mirror the server-side cascade — drop the row + every
      // descendant locally so the canvas reflects the deletion
      // immediately, even when the WS is dead and the per-descendant
@@ -2,7 +2,6 @@

 import { useEffect, useRef, useState } from "react";
 import { api } from "@/lib/api";
-import type RFB from "@novnc/novnc";

 interface DisplayStatus {
  available: boolean;
@@ -12,13 +11,13 @@ interface DisplayStatus {
  protocol?: string;
  width?: number;
  height?: number;
+  viewer_url?: string;
 }

 interface DisplayControlStatus {
  controller: "none" | "user" | "agent";
  controlled_by?: string;
  expires_at?: string;
-  session_url?: string;
 }

 interface Props {
@@ -31,7 +30,6 @@ export function DisplayTab({ workspaceId }: Props) {
  const [error, setError] = useState<string | null>(null);
  const [controlError, setControlError] = useState<string | null>(null);
  const [controlBusy, setControlBusy] = useState(false);
-  const [sessionUrl, setSessionUrl] = useState<string | null>(null);
  const requestGeneration = useRef(0);

  useEffect(() => {
@@ -40,7 +38,6 @@ export function DisplayTab({ workspaceId }: Props) {
    let cancelled = false;
    setStatus(null);
    setControl(null);
-    setSessionUrl(null);
    setError(null);
    setControlError(null);
    setControlBusy(false);
@@ -81,7 +78,6 @@ export function DisplayTab({ workspaceId }: Props) {
      });
      if (requestGeneration.current !== generation) return;
      setControl(next);
-      setSessionUrl(next.session_url || null);
    } catch (err) {
      if (requestGeneration.current !== generation) return;
      setControlError("Failed to take control");
@@ -107,7 +103,6 @@ export function DisplayTab({ workspaceId }: Props) {
      const next = await api.post<DisplayControlStatus>(`${controlPath}/release`, {});
      if (requestGeneration.current !== generation) return;
      setControl(next);
-      setSessionUrl(null);
    } catch (err) {
      if (requestGeneration.current !== generation) return;
      setControlError("Failed to release control");
@@ -229,19 +224,24 @@ export function DisplayTab({ workspaceId }: Props) {
          control={control}
          controlBusy={controlBusy}
          controlError={controlError}
-          hasSession={!!sessionUrl}
          onAcquire={acquireControl}
          onRelease={releaseControl}
        />
      </div>
-      {sessionUrl ? (
-        <DesktopStream sessionUrl={sessionUrl} />
+      {status.viewer_url ? (
+        <iframe
+          title="Workspace desktop"
+          src={status.viewer_url}
+          className="min-h-0 flex-1 border-0 bg-black"
+          allow="clipboard-read; clipboard-write; fullscreen; pointer-lock"
+          referrerPolicy="no-referrer"
+        />
      ) : (
        <div className="flex flex-1 items-center justify-center p-8 text-center">
          <div>
-            <h3 className="mb-1.5 text-sm font-medium text-ink">Take control to open the desktop.</h3>
+            <h3 className="mb-1.5 text-sm font-medium text-ink">Display session is not ready.</h3>
            <p className="max-w-xs text-[11px] leading-relaxed text-ink-mid">
-              The display service is ready. Control access opens a short-lived desktop stream.
+              This workspace has display configuration, but the desktop session URL is not available yet.
            </p>
          </div>
        </div>
@@ -254,22 +254,15 @@ function DisplayControlBar({
  control,
  controlBusy,
  controlError,
-  hasSession,
  onAcquire,
  onRelease,
 }: {
  control: DisplayControlStatus | null;
  controlBusy: boolean;
  controlError: string | null;
-  hasSession: boolean;
  onAcquire: () => void;
  onRelease: () => void;
 }) {
-  const userControl = control?.controller === "user";
-  const adminControl = userControl && control?.controlled_by === "admin-token";
-  const canAcquireUserControl = control?.controller === "none" || (userControl && !hasSession);
-  const canReleaseUserControl = adminControl || (userControl && hasSession);
-
  return (
    <div className="flex min-w-0 items-center gap-3">
      {control && (
@@ -287,7 +280,7 @@ function DisplayControlBar({
          {controlError && <p className="mt-0.5 text-[10px] text-red-200">{controlError}</p>}
        </div>
      )}
-      {canAcquireUserControl && (
+      {control?.controller === "none" && (
        <button
          type="button"
          onClick={onAcquire}
@@ -297,7 +290,7 @@ function DisplayControlBar({
          Take control
        </button>
      )}
-      {canReleaseUserControl && (
+      {control?.controller === "user" && control.controlled_by === "admin-token" && (
        <button
          type="button"
          onClick={onRelease}
@@ -311,63 +304,6 @@ function DisplayControlBar({
  );
 }

-function DesktopStream({ sessionUrl }: { sessionUrl: string }) {
-  const containerRef = useRef<HTMLDivElement | null>(null);
-  const [streamError, setStreamError] = useState<string | null>(null);
-
-  useEffect(() => {
-    let cancelled = false;
-    let rfb: RFB | null = null;
-
-    async function connect() {
-      setStreamError(null);
-      try {
-        const mod = await import("@novnc/novnc");
-        if (cancelled || !containerRef.current) return;
-        const stream = displayWebSocketConnection(sessionUrl);
-        rfb = new mod.default(containerRef.current, stream.url, {
-          wsProtocols: ["binary", `molecule-display-token.${stream.token}`],
-        });
-        rfb.scaleViewport = true;
-        rfb.resizeSession = true;
-        rfb.focusOnClick = true;
-        rfb.addEventListener("disconnect", (event: Event) => {
-          const detail = (event as CustomEvent<{ clean?: boolean }>).detail;
-          if (!cancelled && !detail?.clean) setStreamError("Desktop stream disconnected.");
-        });
-      } catch {
-        if (!cancelled) setStreamError("Desktop stream could not be opened.");
-      }
-    }
-
-    connect();
-    return () => {
-      cancelled = true;
-      rfb?.disconnect();
-    };
-  }, [sessionUrl]);
-
-  return (
-    <div className="relative min-h-0 flex-1 bg-black">
-      <div ref={containerRef} title="Workspace desktop" className="h-full w-full overflow-hidden bg-black" />
-      {streamError && (
-        <div className="absolute inset-x-4 top-4 rounded border border-red-500/30 bg-red-950/80 px-3 py-2 text-[11px] text-red-100">
-          {streamError}
-        </div>
-      )}
-    </div>
-  );
-}
-
-function displayWebSocketConnection(sessionUrl: string): { url: string; token: string } {
-  const url = new URL(sessionUrl, window.location.href);
-  const token = new URLSearchParams(url.hash.replace(/^#/, "")).get("token") ?? "";
-  if (!token) throw new Error("display session token missing");
-  url.hash = "";
-  url.protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
-  return { url: url.toString(), token };
-}
-
 function displayControlActorLabel(control: DisplayControlStatus): string {
  if (control.controller === "agent") return "Agent";
  if (control.controlled_by === "admin-token") return "Admin";
@@ -67,7 +67,7 @@ export function FileEditor({
    return (
      <div className="flex-1 flex items-center justify-center">
        <div className="text-center">
-          <div aria-hidden="true" className="text-2xl opacity-20 mb-2">📄</div>
+          <div className="text-2xl opacity-20 mb-2">📄</div>
          <p className="text-[10px] text-ink-mid">Select a file to edit</p>
        </div>
      </div>
@@ -79,16 +79,16 @@ export function FileEditor({
      {/* File header */}
      <div className="flex items-center justify-between px-3 py-1.5 border-b border-line/40 bg-surface-sunken/20">
        <div className="flex items-center gap-1.5 min-w-0">
-          <span aria-hidden="true" className="text-[10px] opacity-50">{getIcon(selectedFile, false)}</span>
+          <span className="text-[10px] opacity-50">{getIcon(selectedFile, false)}</span>
          <span className="text-[10px] font-mono text-ink-mid truncate">{selectedFile}</span>
          {isDirty && <span className="text-[9px] text-warm">modified</span>}
        </div>
        <div className="flex items-center gap-2">
-          {success && <span role="status" aria-live="polite" className="text-[9px] text-good">{success}</span>}
+          {success && <span className="text-[9px] text-good">{success}</span>}
          <button
            onClick={onDownload}
            aria-label="Download file"
-            className="text-[10px] text-ink-mid hover:text-ink-mid focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            className="text-[10px] text-ink-mid hover:text-ink-mid"
          >
            ↓
          </button>
@@ -96,7 +96,7 @@ export function FileEditor({
            <button
              onClick={onSave}
              disabled={!isDirty || saving}
-              className="text-[10px] text-accent hover:text-accent disabled:opacity-30 focus:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              className="text-[10px] text-accent hover:text-accent disabled:opacity-30"
            >
              {saving ? "Saving..." : "Save"}
            </button>
@@ -166,7 +166,6 @@ export function FileEditor({
            }
          }}
          spellCheck={false}
-          aria-label="File content editor"
          className="flex-1 w-full bg-surface p-3 text-[11px] font-mono text-ink leading-relaxed resize-none focus:outline-none"
          style={{ tabSize: 2 }}
        />
@@ -29,8 +29,8 @@ afterEach(() => {

 const defaultProps = {
  selectedFile: "/configs/agent.yaml",
-  fileContent: "name: test\nruntime: claude-code",
-  editContent: "name: test\nruntime: claude-code",
+  fileContent: "name: test\nruntime: langgraph",
+  editContent: "name: test\nruntime: langgraph",
  setEditContent: vi.fn(),
  loadingFile: false,
  saving: false,
@@ -197,12 +197,12 @@ describe("FileEditor — textarea", () => {
    render(
      <FileEditor
        {...defaultProps}
-        editContent="runtime: claude-code"
+        editContent="runtime: langgraph"
      />,
    );
    const ta = document.querySelector("textarea");
    expect(ta).toBeTruthy();
-    expect(ta?.value).toBe("runtime: claude-code");
+    expect(ta?.value).toBe("runtime: langgraph");
  });

  it("textarea is readOnly when root is not /configs", () => {
@@ -210,7 +210,7 @@ describe("FileEditor — textarea", () => {
      <FileEditor
        {...defaultProps}
        root="/workspace"
-        editContent="runtime: claude-code"
+        editContent="runtime: langgraph"
      />,
    );
    const ta = document.querySelector("textarea");
@@ -222,7 +222,7 @@ describe("FileEditor — textarea", () => {
      <FileEditor
        {...defaultProps}
        root="/configs"
-        editContent="runtime: claude-code"
+        editContent="runtime: langgraph"
      />,
    );
    const ta = document.querySelector("textarea");
@@ -78,11 +78,11 @@ describe("walkEntry — file entry", () => {
  });

  it("populates the File object with correct content", async () => {
-    const { entry, file } = makeFile("config.yaml", "runtime: claude-code");
+    const { entry, file } = makeFile("config.yaml", "runtime: langgraph");
    const out: CollectedEntry[] = [];
    await walkEntry(entry as never, "", out);
    expect(out[0]!.file).toBe(file);
-    expect(await out[0]!.file.text()).toBe("runtime: claude-code");
+    expect(await out[0]!.file.text()).toBe("runtime: langgraph");
  });

  it("appends to existing entries array (non-destructive)", async () => {
@@ -0,0 +1,471 @@
+"use client";
+
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { api } from "@/lib/api";
+
+interface Props {
+  workspaceId: string;
+}
+
+interface MemoryEntry {
+  key: string;
+  value: unknown;
+  version?: number;
+  expires_at: string | null;
+  updated_at: string;
+}
+
+const AWARENESS_BASE_URL =
+  process.env.NEXT_PUBLIC_AWARENESS_URL || "http://localhost:37800";
+
+export function MemoryTab({ workspaceId }: Props) {
+  const [entries, setEntries] = useState<MemoryEntry[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [showAwareness, setShowAwareness] = useState(true);
+  const [showAdvanced, setShowAdvanced] = useState(false);
+  const [expanded, setExpanded] = useState<string | null>(null);
+  const [showAdd, setShowAdd] = useState(false);
+  const [newKey, setNewKey] = useState("");
+  const [newValue, setNewValue] = useState("");
+  const [newTTL, setNewTTL] = useState("");
+  const [error, setError] = useState<string | null>(null);
+  const [editingKey, setEditingKey] = useState<string | null>(null);
+  const [editValue, setEditValue] = useState("");
+  const [editTTL, setEditTTL] = useState("");
+  const [editError, setEditError] = useState<string | null>(null);
+
+  const awarenessUrl = useMemo(() => {
+    try {
+      const url = new URL(AWARENESS_BASE_URL);
+      url.searchParams.set("workspaceId", workspaceId);
+      return url.toString();
+    } catch {
+      return AWARENESS_BASE_URL;
+    }
+  }, [workspaceId]);
+
+  const awarenessStatus = useMemo(() => {
+    try {
+      const url = new URL(AWARENESS_BASE_URL);
+      return url.origin.includes("localhost") ? "local" : url.hostname;
+    } catch {
+      return "unavailable";
+    }
+  }, []);
+
+  const loadMemory = useCallback(async () => {
+    setLoading(true);
+    setError(null);
+    try {
+      const data = await api.get<MemoryEntry[]>(`/workspaces/${workspaceId}/memory`);
+      setEntries(data);
+    } catch (e) {
+      setEntries([]);
+      setError(e instanceof Error ? e.message : "Failed to load memory");
+    } finally {
+      setLoading(false);
+    }
+  }, [workspaceId]);
+
+  useEffect(() => {
+    loadMemory();
+  }, [loadMemory]);
+
+  const handleAdd = async () => {
+    setError(null);
+    if (!newKey.trim()) {
+      setError("Key is required");
+      return;
+    }
+
+    let parsedValue: unknown;
+    try {
+      parsedValue = JSON.parse(newValue);
+    } catch {
+      parsedValue = newValue;
+    }
+
+    const body: Record<string, unknown> = { key: newKey, value: parsedValue };
+    if (newTTL) {
+      const ttl = parseInt(newTTL);
+      if (!Number.isNaN(ttl) && ttl > 0) body.ttl_seconds = ttl;
+    }
+
+    try {
+      await api.post(`/workspaces/${workspaceId}/memory`, body);
+      setNewKey("");
+      setNewValue("");
+      setNewTTL("");
+      setShowAdd(false);
+      loadMemory();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "Failed to add");
+    }
+  };
+
+  const handleDelete = async (key: string) => {
+    setError(null);
+    try {
+      await api.del(`/workspaces/${workspaceId}/memory/${encodeURIComponent(key)}`);
+      setEntries((prev) => prev.filter((e) => e.key !== key));
+      if (expanded === key) setExpanded(null);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "Failed to delete entry");
+    }
+  };
+
+  const beginEdit = (entry: MemoryEntry) => {
+    setEditError(null);
+    setEditingKey(entry.key);
+    // Stringify objects/arrays as pretty JSON; render plain strings raw so the
+    // editor doesn't surprise users with surrounding quotes.
+    setEditValue(
+      typeof entry.value === "string"
+        ? entry.value
+        : JSON.stringify(entry.value, null, 2),
+    );
+    if (entry.expires_at) {
+      const remainingMs = new Date(entry.expires_at).getTime() - Date.now();
+      const ttl = Math.max(0, Math.floor(remainingMs / 1000));
+      setEditTTL(ttl > 0 ? String(ttl) : "");
+    } else {
+      setEditTTL("");
+    }
+  };
+
+  const cancelEdit = () => {
+    setEditingKey(null);
+    setEditValue("");
+    setEditTTL("");
+    setEditError(null);
+  };
+
+  const handleEditSave = async (entry: MemoryEntry) => {
+    setEditError(null);
+
+    let parsedValue: unknown;
+    try {
+      parsedValue = JSON.parse(editValue);
+    } catch {
+      parsedValue = editValue;
+    }
+
+    // if_match_version closes the silent-overwrite hole when two writers
+    // race. The handler returns 409 with the current version on mismatch
+    // — surface that as a retry hint and reload to pick up the new state.
+    const body: Record<string, unknown> = { key: entry.key, value: parsedValue };
+    if (typeof entry.version === "number") {
+      body.if_match_version = entry.version;
+    }
+    if (editTTL) {
+      const ttl = parseInt(editTTL);
+      if (!Number.isNaN(ttl) && ttl > 0) body.ttl_seconds = ttl;
+    }
+
+    try {
+      await api.post(`/workspaces/${workspaceId}/memory`, body);
+      cancelEdit();
+      loadMemory();
+    } catch (e) {
+      const message = e instanceof Error ? e.message : "Failed to save";
+      if (message.includes("409") || /if_match_version mismatch/i.test(message)) {
+        setEditError("This entry changed since you opened it. Reloading.");
+        loadMemory();
+      } else {
+        setEditError(message);
+      }
+    }
+  };
+
+  const openAwareness = () => {
+    window.open(awarenessUrl, "_blank", "noopener,noreferrer");
+  };
+
+  if (loading) {
+    return <div className="p-4 text-xs text-ink-mid">Loading memory...</div>;
+  }
+
+  return (
+    <div className="p-4 space-y-4">
+      {error && !showAdd && (
+        <div role="alert" className="px-3 py-1.5 bg-red-900/30 border border-red-800 rounded text-xs text-bad">
+          {error}
+        </div>
+      )}
+
+      <section className="space-y-3">
+        <div className="flex items-center justify-between gap-3">
+          <div>
+            <div className="text-xs font-medium text-ink">Awareness dashboard</div>
+            <p className="text-[10px] text-ink-mid">
+              Embedded view for the local Awareness memory UI. The current workspace id is appended to the URL for workspace-scoped routing or future filtering.
+            </p>
+          </div>
+          <div className="flex items-center gap-2">
+            <button
+              type="button"
+              onClick={() => setShowAwareness((prev) => !prev)}
+              className="shrink-0 px-2 py-1 bg-surface-card hover:bg-surface-elevated text-[10px] rounded text-ink focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              {showAwareness ? "Collapse" : "Expand"}
+            </button>
+            <button
+              type="button"
+              onClick={openAwareness}
+              className="shrink-0 px-2 py-1 bg-surface-card hover:bg-surface-elevated text-[10px] rounded text-ink focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              Open
+            </button>
+          </div>
+        </div>
+
+        {showAwareness ? (
+          AWARENESS_BASE_URL ? (
+            <div className="overflow-hidden rounded-xl border border-line bg-surface-sunken/70 shadow-[0_0_0_1px_rgba(255,255,255,0.02)]">
+              <iframe
+                title="Awareness dashboard"
+                src={awarenessUrl}
+                className="h-[520px] w-full border-0"
+                loading="lazy"
+              />
+            </div>
+          ) : (
+            <div className="rounded-xl border border-dashed border-line bg-surface-sunken/40 p-4 text-xs text-ink-mid">
+              Set <code className="font-mono text-ink-mid">NEXT_PUBLIC_AWARENESS_URL</code> to embed the Awareness dashboard here.
+            </div>
+          )
+        ) : (
+          <div className="rounded-xl border border-line bg-surface-sunken/50 px-4 py-3 flex items-center justify-between gap-3">
+            <div className="min-w-0">
+              <p className="text-xs text-ink">Awareness dashboard is collapsed</p>
+              <p className="text-[10px] text-ink-mid truncate">
+                Workspace context stays linked through <span className="font-mono text-ink-mid">{workspaceId}</span>.
+              </p>
+            </div>
+            <button
+              type="button"
+              onClick={() => setShowAwareness(true)}
+              className="shrink-0 px-2 py-1 bg-accent hover:bg-accent-strong text-[10px] rounded text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              Expand
+            </button>
+          </div>
+        )}
+
+        <div className="grid gap-2 rounded-xl border border-line bg-surface/40 px-3 py-2 text-[10px] text-ink-mid sm:grid-cols-3">
+          <div className="flex items-center justify-between gap-2">
+            <span className="uppercase tracking-[0.18em] text-ink-mid">Status</span>
+            <span className="font-medium text-good">Connected</span>
+          </div>
+          <div className="flex items-center justify-between gap-2">
+            <span className="uppercase tracking-[0.18em] text-ink-mid">Mode</span>
+            <span className="font-medium text-ink">{awarenessStatus}</span>
+          </div>
+          <div className="flex items-center justify-between gap-2 min-w-0">
+            <span className="uppercase tracking-[0.18em] text-ink-mid">Workspace</span>
+            <span className="font-mono text-ink-mid truncate">{workspaceId}</span>
+          </div>
+        </div>
+      </section>
+
+      <section className="space-y-3 border-t border-line/60 pt-4">
+        <div className="flex items-center justify-between">
+          <div>
+            <div className="text-xs font-medium text-ink">Workspace KV memory</div>
+            <p className="text-[10px] text-ink-mid">
+              Native platform key-value memory for workspace <span className="font-mono text-ink-mid">{workspaceId}</span>.
+            </p>
+          </div>
+          <div className="flex gap-2">
+            <button
+              type="button"
+              onClick={() => setShowAdvanced((prev) => !prev)}
+              className="px-2 py-1 bg-surface-card hover:bg-surface-elevated text-[10px] rounded text-ink-mid focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              {showAdvanced ? "Hide Advanced" : "Advanced"}
+            </button>
+            <button
+              type="button"
+              onClick={loadMemory}
+              className="px-2 py-1 bg-surface-card hover:bg-surface-elevated text-[10px] rounded text-ink-mid focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              Refresh
+            </button>
+            <button
+              type="button"
+              onClick={() => { setShowAdd(!showAdd); if (!showAdd) setShowAdvanced(true); }}
+              className="px-2 py-1 bg-accent hover:bg-accent-strong text-[10px] rounded text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              + Add
+            </button>
+          </div>
+        </div>
+
+        {showAdvanced && showAdd && (
+          <div className="bg-surface-card rounded p-3 space-y-2 border border-line">
+            <input
+              value={newKey}
+              onChange={(e) => setNewKey(e.target.value)}
+              placeholder="Key"
+              aria-label="Memory key"
+              className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-xs text-ink focus:outline-none focus:border-accent"
+            />
+            <textarea
+              value={newValue}
+              onChange={(e) => setNewValue(e.target.value)}
+              placeholder='Value (JSON or plain text)'
+              rows={3}
+              aria-label="Memory value (JSON or plain text)"
+              className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-xs font-mono text-ink focus:outline-none focus:border-accent resize-none"
+            />
+            <input
+              value={newTTL}
+              onChange={(e) => setNewTTL(e.target.value)}
+              placeholder="TTL in seconds (optional)"
+              aria-label="TTL in seconds (optional)"
+              className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-xs text-ink focus:outline-none focus:border-accent"
+            />
+            {error && <div role="alert" className="text-xs text-bad">{error}</div>}
+            <div className="flex gap-2">
+              <button
+                type="button"
+                onClick={handleAdd}
+                className="px-3 py-1 bg-accent hover:bg-accent-strong text-xs rounded text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              >
+                Save
+              </button>
+              <button
+                type="button"
+                onClick={() => {
+                  setShowAdd(false);
+                  setError(null);
+                }}
+                className="px-3 py-1 bg-surface-card hover:bg-surface-elevated text-xs rounded text-ink-mid focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+              >
+                Cancel
+              </button>
+            </div>
+          </div>
+        )}
+
+        {showAdvanced ? (
+          entries.length === 0 ? (
+            <p className="text-xs text-ink-mid text-center py-4">No memory entries</p>
+          ) : (
+            <div className="space-y-1">
+              {entries.map((entry) => (
+                <div key={entry.key} className="bg-surface-card rounded border border-line">
+                  <button
+                    type="button"
+                    onClick={() => setExpanded(expanded === entry.key ? null : entry.key)}
+                    className="w-full flex items-center justify-between px-3 py-2 text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+                    aria-expanded={expanded === entry.key}
+                  >
+                    <span className="text-xs font-mono text-accent">{entry.key}</span>
+                    <div className="flex items-center gap-2">
+                      {entry.expires_at && (
+                        <span className="text-[9px] text-ink-mid">
+                          TTL {new Date(entry.expires_at).toLocaleString()}
+                        </span>
+                      )}
+                      <span className="text-[10px] text-ink-mid">
+                        {expanded === entry.key ? "▼" : "▶"}
+                      </span>
+                    </div>
+                  </button>
+
+                  {expanded === entry.key && (
+                    <div className="px-3 pb-2 space-y-2">
+                      {editingKey === entry.key ? (
+                        <div className="space-y-2">
+                          <textarea
+                            value={editValue}
+                            onChange={(e) => setEditValue(e.target.value)}
+                            rows={4}
+                            aria-label={`Edit value for ${entry.key}`}
+                            className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-xs font-mono text-ink focus:outline-none focus:border-accent resize-none"
+                          />
+                          <input
+                            value={editTTL}
+                            onChange={(e) => setEditTTL(e.target.value)}
+                            placeholder="TTL in seconds (blank = no expiry)"
+                            aria-label={`Edit TTL for ${entry.key}`}
+                            className="w-full bg-surface-sunken border border-line rounded px-2 py-1 text-xs text-ink focus:outline-none focus:border-accent"
+                          />
+                          {editError && (
+                            <div role="alert" className="text-[10px] text-bad">
+                              {editError}
+                            </div>
+                          )}
+                          <div className="flex gap-2">
+                            <button
+                              type="button"
+                              onClick={() => handleEditSave(entry)}
+                              className="px-3 py-1 bg-accent hover:bg-accent-strong text-xs rounded text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+                            >
+                              Save
+                            </button>
+                            <button
+                              type="button"
+                              onClick={cancelEdit}
+                              className="px-3 py-1 bg-surface-card hover:bg-surface-elevated text-xs rounded text-ink-mid focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+                            >
+                              Cancel
+                            </button>
+                          </div>
+                        </div>
+                      ) : (
+                        <pre className="text-[10px] text-ink-mid bg-surface-sunken rounded p-2 overflow-x-auto max-h-40">
+                          {JSON.stringify(entry.value, null, 2)}
+                        </pre>
+                      )}
+                      <div className="flex items-center justify-between">
+                        <span className="text-[9px] text-ink-mid">
+                          Updated: {new Date(entry.updated_at).toLocaleString()}
+                        </span>
+                        <div className="flex items-center gap-2">
+                          {editingKey !== entry.key && (
+                            <button
+                              type="button"
+                              onClick={() => beginEdit(entry)}
+                              className="text-[10px] text-ink-mid hover:bg-surface-elevated rounded px-1 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+                            >
+                              Edit
+                            </button>
+                          )}
+                          <button
+                            type="button"
+                            onClick={() => handleDelete(entry.key)}
+                            className="text-[10px] text-bad hover:bg-red-950/40 rounded px-1 transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-red-500 focus-visible:ring-offset-1"
+                          >
+                            Delete
+                          </button>
+                        </div>
+                      </div>
+                    </div>
+                  )}
+                </div>
+              ))}
+            </div>
+          )
+        ) : (
+          <div className="rounded-xl border border-line bg-surface/30 px-4 py-3 flex items-center justify-between gap-3">
+            <div className="min-w-0">
+              <p className="text-xs text-ink">Advanced workspace memory is hidden</p>
+              <p className="text-[10px] text-ink-mid truncate">
+                KV entries remain available if you need the raw platform store.
+              </p>
+            </div>
+            <button
+              type="button"
+              onClick={() => setShowAdvanced(true)}
+              className="shrink-0 px-2 py-1 bg-accent hover:bg-accent-strong text-[10px] rounded text-white focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-accent focus-visible:ring-offset-1"
+            >
+              Show
+            </button>
+          </div>
+        )}
+      </section>
+    </div>
+  );
+}
@@ -32,7 +32,7 @@ interface PluginInfo {
  author: string;
  tags: string[];
  skills: string[];
-  // Declared supported runtimes (e.g. ["claude_code", "hermes"]).
+  // Declared supported runtimes (e.g. ["claude_code", "deepagents"]).
  // Empty / absent = "unspecified, try it".
  runtimes?: string[];
  // Only present on /workspaces/:id/plugins responses — true if the
@@ -3,10 +3,10 @@
 // Regression tests for ConfigTab hermes-workspace UX (#1894 + #1900).
 //
 // All four bugs this suite pins hit the same workspace on 2026-04-23:
-// a hermes-runtime workspace whose Config tab showed "Claude Code
+// a hermes-runtime workspace whose Config tab showed "LangGraph
 // (default)" in the runtime dropdown, an empty Model field, and a
 // scary red "No config.yaml found" banner. Clicking Save would
-// silently PATCH runtime back to Claude Code, breaking the workspace.
+// silently PATCH runtime back to LangGraph, breaking the workspace.
 //
 // Each test pins one invariant. If any fails, the bug is back.

@@ -91,7 +91,7 @@ describe("ConfigTab — hermes workspace", () => {
  it("loads runtime from workspace metadata when config.yaml is missing (#1894 bug 1)", async () => {
    // This is the hermes case: no platform config.yaml, so the form must
    // fall back to GET /workspaces/:id's runtime field. Before the fix, the
-    // runtime dropdown showed "Claude Code (default)" because the fallback
+    // runtime dropdown showed "LangGraph (default)" because the fallback
    // didn't exist.
    wireApi({
      workspaceRuntime: "hermes",
@@ -150,9 +150,9 @@ describe("ConfigTab — hermes workspace", () => {
    expect(screen.queryByText(/Hermes manages its own config/i)).toBeNull();
  });

-  it("DOES show 'No config.yaml found' error for claude-code workspace (default runtime)", async () => {
+  it("DOES show 'No config.yaml found' error for langgraph workspace (default runtime)", async () => {
    // Regression guard the other way — the gray info banner is hermes-
-    // specific. A claude-code workspace with no config.yaml SHOULD still
+    // specific. A langgraph workspace with no config.yaml SHOULD still
    // see the red error so the user knows to provide a template config.
    wireApi({
      workspaceRuntime: "",
@@ -302,21 +302,21 @@ describe("ConfigTab — config.yaml on disk", () => {
    // MCP server list, etc.) but runtime/model/tier come from the
    // workspace row so the node badge matches the form.
    //
-    // Scenario: DB says "hermes", config.yaml says "openclaw". The form
+    // Scenario: DB says "hermes", config.yaml says "crewai". The form
    // must show hermes (DB wins).
    //
-    // We pick hermes (not claude-code) on the DB side because "claude-code"
-    // is collapsed to the empty-string "Claude Code (default)" option in
-    // the runtime dropdown — so a "claude-code" DB value would render as
+    // We pick hermes (not langgraph) on the DB side because "langgraph"
+    // is collapsed to the empty-string "LangGraph (default)" option in
+    // the runtime dropdown — so a "langgraph" DB value would render as
    // the empty-valued option and obscure whether the DB-wins logic
    // actually fired. Hermes has its own non-empty option value and
    // gives the assertion a clean signal.
    wireApi({
      workspaceRuntime: "hermes", // DB — authoritative
-      configYamlContent: 'runtime: openclaw\nmodel: "claude-opus"\n',
+      configYamlContent: 'runtime: crewai\nmodel: "claude-opus"\n',
      templates: [
        { id: "t-hermes", name: "Hermes", runtime: "hermes", models: [] },
-        { id: "t-openclaw", name: "OpenClaw", runtime: "openclaw", models: [] },
+        { id: "t-crewai", name: "CrewAI", runtime: "crewai", models: [] },
      ],
    });

@@ -1,66 +1,21 @@
 // @vitest-environment jsdom
-import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const apiPatch = vi.fn();
-const updateNodeData = vi.fn();
-const restartWorkspace = vi.fn();
-
-vi.mock("@/lib/api", () => ({
-  api: {
-    patch: (path: string, body: unknown) => apiPatch(path, body),
-  },
-}));
+import { cleanup, render, screen } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";

 vi.mock("@/lib/runtime-names", () => ({
  runtimeDisplayName: (runtime: string) => runtime,
 }));

-vi.mock("@/store/canvas", () => ({
-  useCanvasStore: Object.assign(
-    (selector: (s: unknown) => unknown) => selector({ restartWorkspace, updateNodeData }),
-    { getState: () => ({ restartWorkspace, updateNodeData }) },
-  ),
-}));
-
 import { ContainerConfigTab } from "../ContainerConfigTab";

 afterEach(() => {
  cleanup();
 });

-beforeEach(() => {
-  apiPatch.mockReset();
-  restartWorkspace.mockReset();
-  updateNodeData.mockReset();
-});
-
 describe("ContainerConfigTab", () => {
-  it("defaults missing compute to the cost-efficient headless profile", () => {
+  it("renders read-only runtime and container settings separate from compute shape", () => {
    render(
      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: undefined,
-        }}
-      />,
-    );
-
-    expect(screen.getByLabelText("Instance type")).toHaveProperty("value", "t3.medium");
-    expect(screen.getByLabelText("Root volume")).toHaveProperty("value", "30");
-  });
-
-  it("renders persisted compute and status settings", () => {
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
        data={{
          runtime: "claude-code",
          status: "online",
@@ -69,249 +24,19 @@ describe("ContainerConfigTab", () => {
          maxConcurrentTasks: 3,
          workspaceAccess: "read_write",
          deliveryMode: "poll",
-          compute: {
-            instance_type: "t3.xlarge",
-            volume: { root_gb: 80 },
-            display: { mode: "desktop-control", protocol: "novnc", width: 1920, height: 1080 },
-          },
        }}
      />,
    );

-    expect(screen.getByLabelText("Runtime image")).toHaveProperty("value", "claude-code");
-    expect(screen.getByLabelText("Instance type")).toHaveProperty("value", "t3.xlarge");
-    expect(screen.getByLabelText("Root volume")).toHaveProperty("value", "80");
-    expect(screen.getByLabelText("Enable display")).toHaveProperty("checked", true);
-    expect(screen.getByLabelText("Resolution")).toHaveProperty("value", "1920x1080");
+    expect(screen.getByText("Runtime image")).toBeTruthy();
+    expect(screen.getByText("claude-code")).toBeTruthy();
    expect(screen.getByText("Workspace access")).toBeTruthy();
    expect(screen.getByText("read-write")).toBeTruthy();
-  });
-
-  it("does not reset dirty form edits on unrelated status rerender", () => {
-    const { rerender } = render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    fireEvent.change(screen.getByLabelText("Root volume"), { target: { value: "120" } });
-
-    rerender(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 1,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    expect(screen.getByLabelText("Root volume")).toHaveProperty("value", "120");
-  });
-
-  it("saves runtime and compute changes through workspace PATCH", async () => {
-    apiPatch.mockResolvedValueOnce({ needs_restart: true });
-
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    fireEvent.change(screen.getByLabelText("Runtime image"), { target: { value: "hermes" } });
-    fireEvent.change(screen.getByLabelText("Instance type"), { target: { value: "m6i.xlarge" } });
-    fireEvent.change(screen.getByLabelText("Root volume"), { target: { value: "100" } });
-    fireEvent.click(screen.getByLabelText("Enable display"));
-    fireEvent.change(screen.getByLabelText("Resolution"), { target: { value: "2560x1440" } });
-    fireEvent.click(screen.getByRole("button", { name: "Save" }));
-
-    await waitFor(() => expect(apiPatch).toHaveBeenCalledTimes(1));
-    expect(apiPatch).toHaveBeenCalledWith("/workspaces/ws-compute", {
-      runtime: "hermes",
-      compute: {
-        instance_type: "m6i.xlarge",
-        volume: { root_gb: 100 },
-        display: { mode: "desktop-control", protocol: "novnc", width: 2560, height: 1440 },
-      },
-    });
-    expect(updateNodeData).toHaveBeenCalledWith("ws-compute", {
-      runtime: "hermes",
-      compute: {
-        instance_type: "m6i.xlarge",
-        volume: { root_gb: 100 },
-        display: { mode: "desktop-control", protocol: "novnc", width: 2560, height: 1440 },
-      },
-      needsRestart: true,
-      applyTemplateOnRestart: true,
-    });
-    expect(restartWorkspace).not.toHaveBeenCalled();
-  });
-
-  it("preserves existing custom display mode and resolution when saving unrelated compute", async () => {
-    apiPatch.mockResolvedValueOnce({ needs_restart: true });
-
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "gpu-desktop-control", protocol: "dcv", width: 1600, height: 1000 },
-          },
-        }}
-      />,
-    );
-
-    expect(screen.getByLabelText("Resolution")).toHaveProperty("value", "1600x1000");
-
-    fireEvent.change(screen.getByLabelText("Instance type"), { target: { value: "t3.xlarge" } });
-    fireEvent.click(screen.getByRole("button", { name: "Save" }));
-
-    await waitFor(() => expect(apiPatch).toHaveBeenCalledTimes(1));
-    expect(apiPatch).toHaveBeenCalledWith("/workspaces/ws-compute", {
-      runtime: "claude-code",
-      compute: {
-        instance_type: "t3.xlarge",
-        volume: { root_gb: 50 },
-        display: { mode: "gpu-desktop-control", protocol: "dcv", width: 1600, height: 1000 },
-      },
-    });
-  });
-
-  it("can save changed compute and restart the workspace to apply it", async () => {
-    apiPatch.mockResolvedValueOnce({ needs_restart: true });
-    restartWorkspace.mockResolvedValueOnce(undefined);
-
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    fireEvent.change(screen.getByLabelText("Instance type"), { target: { value: "t3.xlarge" } });
-    fireEvent.click(screen.getByRole("button", { name: "Save & Restart" }));
-
-    await waitFor(() => expect(apiPatch).toHaveBeenCalledTimes(1));
-    await waitFor(() => expect(restartWorkspace).toHaveBeenCalledWith("ws-compute", { applyTemplate: false }));
-  });
-
-  it("requests template re-apply when saving a runtime change and restarting", async () => {
-    apiPatch.mockResolvedValueOnce({ needs_restart: true });
-    restartWorkspace.mockResolvedValueOnce(undefined);
-
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: false,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    fireEvent.change(screen.getByLabelText("Runtime image"), { target: { value: "hermes" } });
-    fireEvent.click(screen.getByRole("button", { name: "Save & Restart" }));
-
-    await waitFor(() => expect(restartWorkspace).toHaveBeenCalledWith("ws-compute", { applyTemplate: true }));
-  });
-
-  it("can restart without re-saving when changes are already pending", async () => {
-    restartWorkspace.mockResolvedValueOnce(undefined);
-
-    render(
-      <ContainerConfigTab
-        workspaceId="ws-compute"
-        data={{
-          runtime: "claude-code",
-          status: "online",
-          needsRestart: true,
-          activeTasks: 0,
-          maxConcurrentTasks: null,
-          workspaceAccess: "none",
-          deliveryMode: "push",
-          applyTemplateOnRestart: true,
-          compute: {
-            instance_type: "t3.large",
-            volume: { root_gb: 50 },
-            display: { mode: "none" },
-          },
-        }}
-      />,
-    );
-
-    fireEvent.click(screen.getByRole("button", { name: "Restart to apply" }));
-
-    await waitFor(() => expect(restartWorkspace).toHaveBeenCalledWith("ws-compute", { applyTemplate: true }));
-    expect(apiPatch).not.toHaveBeenCalled();
+    expect(screen.getByText("Max concurrent tasks")).toBeTruthy();
+    expect(screen.getByText("3")).toBeTruthy();
+    expect(screen.getByText("/workspace")).toBeTruthy();
+    expect(screen.getByText("Container privileges")).toBeTruthy();
+    expect(screen.queryByText("Instance type")).toBeNull();
+    expect(screen.queryByText("Root volume")).toBeNull();
  });
 });
@@ -290,9 +290,7 @@ describe("DetailsTab — delete workflow", () => {
    ) as HTMLButtonElement;
    fireEvent(confirmBtn, new MouseEvent("click", { bubbles: true }));
    await flush();
-    expect(mockApi.del).toHaveBeenCalledWith("/workspaces/ws-1?confirm=true", {
-      headers: { "X-Confirm-Name": "Test Workspace" },
-    });
+    expect(mockApi.del).toHaveBeenCalledWith("/workspaces/ws-1?confirm=true");
    expect(mockRemoveSubtree).toHaveBeenCalledWith("ws-1");
    expect(mockSelectNode).toHaveBeenCalledWith(null);
  });
@@ -2,11 +2,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";

-const { mockGet, mockPost, mockRFBConstructor } = vi.hoisted(() => ({
-  mockGet: vi.fn(),
-  mockPost: vi.fn(),
-  mockRFBConstructor: vi.fn(),
-}));
+const { mockGet, mockPost } = vi.hoisted(() => ({ mockGet: vi.fn(), mockPost: vi.fn() }));

 vi.mock("@/lib/api", () => ({
  api: {
@@ -15,25 +11,6 @@ vi.mock("@/lib/api", () => ({
  },
 }));

-vi.mock("@novnc/novnc", () => ({
-  default: class MockRFB extends EventTarget {
-    scaleViewport = false;
-    resizeSession = false;
-    focusOnClick = false;
-    target: HTMLElement;
-    url: string;
-    options?: { wsProtocols?: string[] };
-    constructor(target: HTMLElement, url: string, options?: { wsProtocols?: string[] }) {
-      super();
-      this.target = target;
-      this.url = url;
-      this.options = options;
-      mockRFBConstructor(target, url, options);
-    }
-    disconnect() {}
-  },
-}));
-
 import { DisplayTab } from "../DisplayTab";

 describe("DisplayTab", () => {
@@ -41,7 +18,6 @@ describe("DisplayTab", () => {
    cleanup();
    mockGet.mockReset();
    mockPost.mockReset();
-    mockRFBConstructor.mockReset();
  });

  it("renders unavailable state for non-display workspaces", async () => {
@@ -95,14 +71,15 @@ describe("DisplayTab", () => {
    });
  });

-  it("waits for takeover before opening a ready display stream", async () => {
+  it("renders the desktop stream when a display session is available", async () => {
    mockGet
      .mockResolvedValueOnce({
        available: true,
        mode: "desktop-control",
-        protocol: "novnc",
+        protocol: "dcv",
        width: 1920,
        height: 1080,
+        viewer_url: "https://display.example.test/session/ws-display",
      })
      .mockResolvedValueOnce({
        controller: "none",
@@ -110,51 +87,12 @@ describe("DisplayTab", () => {

    render(<DisplayTab workspaceId="ws-display" />);

-    await waitFor(() => {
-      expect(screen.getByText("Take control to open the desktop.")).toBeTruthy();
-    });
-    expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-  });
-
-  it("opens the trusted noVNC client after takeover returns a stream URL", async () => {
-    mockGet
-      .mockResolvedValueOnce({
-        available: true,
-        mode: "desktop-control",
-        protocol: "novnc",
-        width: 1920,
-        height: 1080,
-      })
-      .mockResolvedValueOnce({
-        controller: "none",
-      });
-    mockPost.mockResolvedValueOnce({
-      controller: "user",
-      controlled_by: "admin-token",
-      expires_at: "2026-05-23T08:48:27Z",
-      session_url: "/workspaces/ws-display/display/session/websockify#token=signed",
-    });
-
-    render(<DisplayTab workspaceId="ws-display" />);
-
-    await waitFor(() => {
-      expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
-    });
-    fireEvent.click(screen.getByRole("button", { name: "Take control" }));
-
    await waitFor(() => {
      expect(screen.getByTitle("Workspace desktop")).toBeTruthy();
    });
-    expect(mockPost).toHaveBeenCalledWith("/workspaces/ws-display/display/control/acquire", {
-      controller: "user",
-      ttl_seconds: 300,
-    });
-    expect(mockRFBConstructor).toHaveBeenCalledWith(
-      expect.any(HTMLElement),
-      expect.stringContaining("/workspaces/ws-display/display/session/websockify"),
-      { wsProtocols: ["binary", "molecule-display-token.signed"] },
-    );
-    expect(mockRFBConstructor.mock.calls[0][1]).not.toContain("token=");
+    const frame = screen.getByTitle("Workspace desktop") as HTMLIFrameElement;
+    expect(frame.src).toBe("https://display.example.test/session/ws-display");
+    expect(screen.getByRole("button", { name: "Take control" })).toBeTruthy();
  });

  it("releases user display control", async () => {
@@ -162,7 +100,8 @@ describe("DisplayTab", () => {
      .mockResolvedValueOnce({
        available: true,
        mode: "desktop-control",
-        protocol: "novnc",
+        protocol: "dcv",
+        viewer_url: "https://display.example.test/session/ws-display",
      })
      .mockResolvedValueOnce({
        controller: "user",
@@ -0,0 +1,632 @@
+// @vitest-environment jsdom
+/**
+ * Tests for MemoryTab — awareness dashboard + workspace KV memory management.
+ *
+ * Coverage:
+ *   - Loading state
+ *   - Error state when GET /memory fails
+ *   - Empty state (no memory entries)
+ *   - Memory list rendering (single + multiple entries)
+ *   - Expand/collapse memory entries
+ *   - Add memory entry (key + value + TTL)
+ *   - Add validates required key
+ *   - Add parses JSON values
+ *   - Delete memory entry
+ *   - Edit memory entry (inline)
+ *   - Edit 409 conflict shows retry hint
+ *   - Advanced toggle shows/hides KV section
+ *   - Awareness dashboard expand/collapse
+ *   - Awareness URL includes workspaceId
+ *   - Refresh button reloads memory
+ *   - Error clears when appropriate actions are taken
+ */
+import React from "react";
+import { render, screen, fireEvent, cleanup, act, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { MemoryTab } from "../MemoryTab";
+
+const mockGet = vi.hoisted(() => vi.fn<[], Promise<unknown[]>>());
+const mockPost = vi.hoisted(() => vi.fn<[], Promise<unknown>>());
+const mockDel = vi.hoisted(() => vi.fn<[], Promise<unknown>>());
+
+vi.mock("@/lib/api", () => ({
+  api: { get: mockGet, post: mockPost, del: mockDel },
+}));
+
+// ─── Fixtures ─────────────────────────────────────────────────────────────────
+
+const MEMORY_ENTRY = {
+  key: "user_context",
+  value: { name: "Alice", role: "engineer" },
+  version: 3,
+  expires_at: null,
+  updated_at: new Date(Date.now() - 60000).toISOString(),
+};
+
+function entry(overrides: Partial<typeof MEMORY_ENTRY> = {}): typeof MEMORY_ENTRY {
+  return { ...MEMORY_ENTRY, ...overrides };
+}
+
+// ─── Helpers ───────────────────────────────────────────────────────────────────
+
+async function flush() {
+  await act(async () => { await Promise.resolve(); });
+}
+
+function typeIn(el: HTMLElement, value: string) {
+  Object.defineProperty(el, "value", { value, writable: true, configurable: true });
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  fireEvent.change(el as any, { target: el });
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────────────
+
+describe("MemoryTab", () => {
+  beforeEach(() => {
+    mockGet.mockReset();
+    mockPost.mockReset();
+    mockDel.mockReset();
+    vi.useRealTimers();
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.useRealTimers();
+  });
+
+  // ── Loading / Error ──────────────────────────────────────────────────────────
+
+  it("shows loading state when memory is being fetched", async () => {
+    mockGet.mockImplementation(() => new Promise(() => {}));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await act(async () => { /* flush initial render */ });
+    expect(screen.getByText("Loading memory...")).toBeTruthy();
+  });
+
+  it("shows error banner when GET /memory rejects", async () => {
+    mockGet.mockRejectedValue(new Error("network failure"));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByText(/network failure/i)).toBeTruthy();
+  });
+
+  it("shows 'Failed to load memory' when GET rejects with non-Error", async () => {
+    mockGet.mockRejectedValue("unknown error");
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByText(/Failed to load memory/i)).toBeTruthy();
+  });
+
+  // ── Awareness Dashboard ─────────────────────────────────────────────────────
+
+  it("shows Awareness dashboard section", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByText("Awareness dashboard")).toBeTruthy();
+  });
+
+  it("renders an iframe with workspaceId in URL", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-xyz" />);
+    await flush();
+    const iframe = screen.getByTitle("Awareness dashboard");
+    expect(iframe.getAttribute("src")).toContain("workspaceId=ws-xyz");
+  });
+
+  it("shows 'Connected' status", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByText("Connected")).toBeTruthy();
+  });
+
+  it("shows workspace ID in the status grid", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-test-id" />);
+    await flush();
+    // workspaceId appears in two places (description + status grid).
+    // Target the font-mono span in the status grid specifically.
+    const spans = Array.from(document.querySelectorAll("span.font-mono"));
+    expect(spans.some(s => s.textContent === "ws-test-id")).toBeTruthy();
+  });
+
+  it("shows 'Collapse' and 'Open' buttons for awareness (starts visible)", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByRole("button", { name: /collapse/i })).toBeTruthy();
+    expect(screen.getByRole("button", { name: /open/i })).toBeTruthy();
+  });
+
+  it("hides awareness iframe when Collapse is clicked", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /collapse/i }));
+    await flush();
+    expect(screen.queryByTitle("Awareness dashboard")).toBeNull();
+    expect(screen.getByText(/awareness dashboard is collapsed/i)).toBeTruthy();
+  });
+
+  it("re-shows awareness iframe when collapsed state Expand is clicked", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    // Start with awareness visible (default) — verify iframe is there
+    expect(screen.getByTitle("Awareness dashboard")).toBeTruthy();
+    // Click Collapse in the awareness header to hide the iframe
+    fireEvent.click(screen.getByRole("button", { name: /collapse/i }));
+    await flush();
+    expect(screen.queryByTitle("Awareness dashboard")).toBeNull();
+    // The collapsed awareness state has a different "Expand" button.
+    // Directly click the button whose text is exactly "Expand".
+    const allBtns = screen.getAllByRole("button");
+    const expandInCollapsed = allBtns.find(b => b.textContent?.trim() === "Expand");
+    expect(expandInCollapsed).toBeTruthy();
+    act(() => { expandInCollapsed!.click(); });
+    await flush();
+    expect(screen.getByTitle("Awareness dashboard")).toBeTruthy();
+  });
+
+  // ── KV Memory: Empty / Advanced toggle ───────────────────────────────────────
+
+  it("shows 'Advanced workspace memory is hidden' when advanced is collapsed", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByText(/advanced workspace memory is hidden/i)).toBeTruthy();
+  });
+
+  it("shows 'Show' button when advanced is collapsed", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    expect(screen.getByRole("button", { name: /show/i })).toBeTruthy();
+  });
+
+  it("shows 'Hide Advanced' after clicking Show", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByRole("button", { name: /hide advanced/i })).toBeTruthy();
+  });
+
+  it("shows empty state 'No memory entries' when advanced is shown and list is empty", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByText("No memory entries")).toBeTruthy();
+  });
+
+  // ── KV Memory: List rendering ───────────────────────────────────────────────
+
+  it("renders memory entries when advanced is open", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByText("user_context")).toBeTruthy();
+  });
+
+  it("renders multiple memory entries", async () => {
+    mockGet.mockResolvedValue([
+      entry({ key: "key1", value: "value1" }),
+      entry({ key: "key2", value: "value2" }),
+    ]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByText("key1")).toBeTruthy();
+    expect(screen.getByText("key2")).toBeTruthy();
+  });
+
+  it("shows chevron pointing right when entry is collapsed", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByText("▶")).toBeTruthy();
+  });
+
+  it("shows chevron pointing down when entry is expanded", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText("▼")).toBeTruthy();
+  });
+
+  it("shows entry value when expanded", async () => {
+    mockGet.mockResolvedValue([entry({ value: { foo: "bar" } })]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText(/"foo": "bar"/)).toBeTruthy();
+  });
+
+  it("shows updated_at timestamp when entry is expanded", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText(/updated:/i)).toBeTruthy();
+  });
+
+  it("shows Edit and Delete buttons when entry is expanded", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByRole("button", { name: /edit/i })).toBeTruthy();
+    expect(screen.getByRole("button", { name: /delete/i })).toBeTruthy();
+  });
+
+  it("shows TTL when entry has expires_at", async () => {
+    const future = new Date(Date.now() + 3600000).toISOString();
+    mockGet.mockResolvedValue([entry({ expires_at: future })]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText(/ttl/i)).toBeTruthy();
+  });
+
+  // ── Add Memory Entry ─────────────────────────────────────────────────────────
+
+  it("shows + Add button in KV section", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    expect(screen.getByRole("button", { name: /\+ add/i })).toBeTruthy();
+  });
+
+  it("opens add form when + Add is clicked", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    expect(screen.getByLabelText("Memory key")).toBeTruthy();
+    expect(screen.getByLabelText("Memory value (JSON or plain text)")).toBeTruthy();
+  });
+
+  it("requires key to be non-empty", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(screen.getByText(/key is required/i)).toBeTruthy();
+  });
+
+  it("POSTs correct payload when adding a string value", async () => {
+    mockGet.mockResolvedValue([]);
+    mockPost.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    typeIn(screen.getByLabelText("Memory key") as HTMLElement, "my_key");
+    typeIn(screen.getByLabelText("Memory value (JSON or plain text)") as HTMLElement, "plain text value");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    await waitFor(() => {
+      expect(screen.queryByLabelText("Memory key")).not.toBeTruthy();
+    });
+    expect(mockPost).toHaveBeenCalledWith(
+      "/workspaces/ws-1/memory",
+      expect.objectContaining({ key: "my_key", value: "plain text value" }),
+    );
+  });
+
+  it("POSTs parsed JSON when value is valid JSON", async () => {
+    mockGet.mockResolvedValue([]);
+    mockPost.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    typeIn(screen.getByLabelText("Memory key") as HTMLElement, "config");
+    typeIn(screen.getByLabelText("Memory value (JSON or plain text)") as HTMLElement, '{"debug": true}');
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(mockPost).toHaveBeenCalledWith(
+      "/workspaces/ws-1/memory",
+      expect.objectContaining({ key: "config", value: { debug: true } }),
+    );
+  });
+
+  it("POSTs with ttl_seconds when TTL is provided", async () => {
+    mockGet.mockResolvedValue([]);
+    mockPost.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    typeIn(screen.getByLabelText("Memory key") as HTMLElement, "temp_data");
+    typeIn(screen.getByLabelText("Memory value (JSON or plain text)") as HTMLElement, "value");
+    typeIn(screen.getByLabelText("TTL in seconds (optional)") as HTMLElement, "3600");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(mockPost).toHaveBeenCalledWith(
+      "/workspaces/ws-1/memory",
+      expect.objectContaining({ key: "temp_data", value: "value", ttl_seconds: 3600 }),
+    );
+  });
+
+  it("shows error when add fails", async () => {
+    mockGet.mockResolvedValue([]);
+    mockPost.mockRejectedValue(new Error("add failed"));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    typeIn(screen.getByLabelText("Memory key") as HTMLElement, "key");
+    typeIn(screen.getByLabelText("Memory value (JSON or plain text)") as HTMLElement, "val");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(screen.getByText(/add failed/i)).toBeTruthy();
+  });
+
+  it("closes add form and refreshes after successful add", async () => {
+    mockGet.mockResolvedValue([]);
+    mockPost.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    typeIn(screen.getByLabelText("Memory key") as HTMLElement, "new_key");
+    typeIn(screen.getByLabelText("Memory value (JSON or plain text)") as HTMLElement, "new_val");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    await waitFor(() => {
+      expect(screen.queryByLabelText("Memory key")).not.toBeTruthy();
+    });
+    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-1/memory");
+  });
+
+  it("closes add form when Cancel is clicked", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /\+ add/i }));
+    await flush();
+    expect(screen.getByLabelText("Memory key")).toBeTruthy();
+    act(() => { screen.getByRole("button", { name: /cancel/i }).click(); });
+    await flush();
+    await waitFor(() => {
+      expect(screen.queryByLabelText("Memory key")).not.toBeTruthy();
+    });
+  });
+
+  // ── Delete Memory Entry ─────────────────────────────────────────────────────
+
+  it("calls DEL when Delete is clicked", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockDel.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /delete/i }));
+    await flush();
+    expect(mockDel).toHaveBeenCalledWith(
+      "/workspaces/ws-1/memory/user_context",
+    );
+  });
+
+  it("removes entry from list after successful delete", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockDel.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText("user_context")).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: /delete/i }));
+    await flush();
+    expect(screen.queryByText("user_context")).toBeFalsy();
+  });
+
+  it("collapses entry if it was expanded when deleted", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockDel.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    // Expand the entry
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    expect(screen.getByText("▼")).toBeTruthy();
+    // Delete
+    fireEvent.click(screen.getByRole("button", { name: /delete/i }));
+    await flush();
+    expect(screen.queryByText("user_context")).toBeFalsy();
+  });
+
+  it("shows error when delete fails", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockDel.mockRejectedValue(new Error("delete failed"));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /delete/i }));
+    await flush();
+    expect(screen.getByText(/delete failed/i)).toBeTruthy();
+  });
+
+  // ── Edit Memory Entry ────────────────────────────────────────────────────────
+
+  it("shows edit form when Edit is clicked", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    expect(screen.getByLabelText(/edit value for user_context/i)).toBeTruthy();
+  });
+
+  it("pre-fills edit form with existing value", async () => {
+    mockGet.mockResolvedValue([entry({ value: { name: "Alice" } })]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    const textarea = screen.getByLabelText(/edit value for user_context/i);
+    expect((textarea as HTMLTextAreaElement).value).toContain("Alice");
+  });
+
+  it("POSTs updated value when Save is clicked", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockPost.mockResolvedValue({});
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    typeIn(screen.getByLabelText(/edit value for user_context/i) as HTMLElement, "updated_value");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    await waitFor(() => {
+      expect(screen.queryByLabelText(/edit value for user_context/i)).not.toBeTruthy();
+    });
+    expect(mockPost).toHaveBeenCalledWith(
+      "/workspaces/ws-1/memory",
+      expect.objectContaining({ key: "user_context", value: "updated_value", if_match_version: 3 }),
+    );
+  });
+
+  it("shows retry hint on 409 conflict during edit", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockPost.mockRejectedValue(new Error("409 Conflict: if_match_version mismatch"));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    typeIn(screen.getByLabelText(/edit value for user_context/i) as HTMLElement, "new_val");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(screen.getByText(/this entry changed since you opened it/i)).toBeTruthy();
+  });
+
+  it("shows generic error when edit save fails", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    mockPost.mockRejectedValue(new Error("save failed"));
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    typeIn(screen.getByLabelText(/edit value for user_context/i) as HTMLElement, "x");
+    await flush();
+    act(() => { screen.getByRole("button", { name: /save/i }).click(); });
+    await flush();
+    expect(screen.getByText(/save failed/i)).toBeTruthy();
+  });
+
+  it("closes edit form when Cancel is clicked", async () => {
+    mockGet.mockResolvedValue([entry()]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /show/i }));
+    await flush();
+    fireEvent.click(screen.getByText("user_context"));
+    await flush();
+    fireEvent.click(screen.getByRole("button", { name: /edit/i }));
+    await flush();
+    expect(screen.getByLabelText(/edit value for user_context/i)).toBeTruthy();
+    act(() => { screen.getByRole("button", { name: /cancel/i }).click(); });
+    await flush();
+    await waitFor(() => {
+      expect(screen.queryByLabelText(/edit value for/i)).not.toBeTruthy();
+    });
+  });
+
+  // ── Refresh ────────────────────────────────────────────────────────────────
+
+  it("Refresh button calls loadMemory", async () => {
+    mockGet.mockResolvedValue([]);
+    render(<MemoryTab workspaceId="ws-1" />);
+    await flush();
+    mockGet.mockClear();
+    fireEvent.click(screen.getByRole("button", { name: /refresh/i }));
+    await flush();
+    expect(mockGet).toHaveBeenCalledWith("/workspaces/ws-1/memory");
+  });
+
+});
@@ -166,12 +166,11 @@ export function AttachmentImage({ workspaceId, attachment, onDownload, tone }: P
        open={open}
        onClose={() => setOpen(false)}
        ariaLabel={`Preview of ${attachment.name}`}
-        contained
      >
        <img
          src={state.blobUrl}
          alt={attachment.name}
-          className="max-w-full max-h-full object-contain"
+          className="max-w-[95vw] max-h-[90vh] object-contain"
        />
      </AttachmentLightbox>
    </>
@@ -1,6 +1,6 @@
 "use client";

-// AttachmentLightbox — shared modal for image / PDF /
+// AttachmentLightbox — shared fullscreen modal for image / PDF /
 // (future) any-fullscreen-renderable kind. Owns:
 //   - Backdrop + centered viewport
 //   - Esc to close
@@ -14,11 +14,11 @@
 //
 // Design choices:
 //
-// 1. Portals — we don't use ReactDOM.createPortal because the chat tab
-//    already gives us a positioned container and the preview should stay
-//    inside that panel. Saves a portal mount in the common case + avoids
-//    the SSR warning (canvas is "use client" but the parent shell is
-//    server-rendered).
+// 1. Portals — we don't use ReactDOM.createPortal because the canvas
+//    chat surface already renders at a high z-index and the modal's
+//    fixed-position layout reaches the viewport regardless. Saves a
+//    portal mount in the common case + avoids the SSR warning (canvas
+//    is "use client" but the parent shell is server-rendered).
 //
 // 2. Focus trap — inline implementation (not a 3rd-party dep). The
 //    chat lightbox needs to trap focus only across two interactive
@@ -41,17 +41,13 @@ interface Props {
   *  the dialog opens. The caller knows what's inside (image alt
   *  text, PDF filename) and supplies it. */
  ariaLabel: string;
-  /** Constrain the preview to the nearest positioned ancestor instead
-   *  of the whole browser viewport. ChatTab passes this so previews
-   *  stay inside the active side-panel tab. */
-  contained?: boolean;
  /** The thing being shown in fullscreen — <img>, <embed>, etc.
   *  Caller is responsible for sizing it to fit the viewport (we
   *  give it max-w-full max-h-full via CSS). */
  children: ReactNode;
 }

-export function AttachmentLightbox({ open, onClose, ariaLabel, contained = false, children }: Props) {
+export function AttachmentLightbox({ open, onClose, ariaLabel, children }: Props) {
  const closeButtonRef = useRef<HTMLButtonElement>(null);
  const previousFocusRef = useRef<HTMLElement | null>(null);

@@ -94,19 +90,12 @@ export function AttachmentLightbox({ open, onClose, ariaLabel, contained = false

  if (!open) return null;

-  const rootClass = contained
-    ? "absolute inset-0 z-50 flex items-center justify-center bg-black/85 motion-reduce:transition-none transition-opacity"
-    : "fixed inset-0 z-50 flex items-center justify-center bg-black/85 motion-reduce:transition-none transition-opacity";
-  const contentClass = contained
-    ? "h-full w-full p-3 flex items-center justify-center"
-    : "max-w-[95vw] max-h-[90vh] flex items-center justify-center";
-
  return (
    <div
      role="dialog"
      aria-modal="true"
      aria-label={ariaLabel}
-      className={rootClass}
+      className="fixed inset-0 z-50 flex items-center justify-center bg-black/85 motion-reduce:transition-none transition-opacity"
      onClick={onBackdropClick}
    >
      {/* Close button — top-right, large hit area, keyboard-focusable.
@@ -123,7 +112,7 @@ export function AttachmentLightbox({ open, onClose, ariaLabel, contained = false
        </svg>
      </button>
      <div
-        className={contentClass}
+        className="max-w-[95vw] max-h-[90vh] flex items-center justify-center"
        onClick={(e) => e.stopPropagation()}
      >
        {children}
@@ -19,8 +19,8 @@
 // suppress the toolbar; we keep it on so the user gets standard
 // PDF affordances.
 //
-// Preview: AttachmentLightbox hosts the PDF inside the active chat tab
-// on click. Same shared modal as image — third caller justifies the
+// Fullscreen: AttachmentLightbox hosts the PDF at viewport size on
+// click. Same shared modal as image — third caller justifies the
 // abstraction (per RFC #2991 design).
 //
 // Failure modes:
@@ -144,15 +144,16 @@ export function AttachmentPDF({ workspaceId, attachment, onDownload, tone }: Pro
        open={open}
        onClose={() => setOpen(false)}
        ariaLabel={`Preview of ${attachment.name}`}
-        contained
      >
-        <div className="h-full w-full overflow-hidden rounded-lg border border-white/20 bg-white shadow-2xl">
-          <iframe
-            src={`${state.blobUrl}#view=FitH`}
-            title={attachment.name}
-            className="h-full w-full bg-white"
-          />
-        </div>
+        <embed
+          src={state.blobUrl}
+          type="application/pdf"
+          // The lightbox's content slot caps at 95vw / 90vh, so size
+          // 100% within that and let the user scroll inside the PDF
+          // viewer.
+          style={{ width: "95vw", height: "90vh" }}
+          aria-label={attachment.name}
+        />
      </AttachmentLightbox>
    </>
  );
@@ -40,7 +40,7 @@ vi.mock("../uploads", () => ({
 }));

 vi.mock("@/lib/api", () => ({
-  platformAuthHeaders: () => ({ Authorization: "Bearer fixture-token" }),
+  platformAuthHeaders: () => ({ Authorization: "Bearer test-token" }),
 }));

 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -41,7 +41,7 @@ vi.mock("../uploads", () => ({
 }));

 vi.mock("@/lib/api", () => ({
-  platformAuthHeaders: () => ({ Authorization: "Bearer fixture-token" }),
+  platformAuthHeaders: () => ({ Authorization: "Bearer test-token" }),
 }));

 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 /**
- * AttachmentLightbox — modal for image / PDF preview.
+ * AttachmentLightbox — fullscreen modal for image / PDF preview.
 *
 * Owns: backdrop + viewport, Esc to close, click-outside to close,
 * focus trap (close button focus on open, restore on close),
@@ -135,22 +135,6 @@ describe("AttachmentLightbox — render", () => {
    const closeBtn = document.querySelector('button[aria-label="Close preview"]');
    expect(closeBtn).toBeTruthy();
  });
-
-  it("uses absolute positioning when contained=true", () => {
-    render(
-      <AttachmentLightbox
-        open={true}
-        onClose={vi.fn()}
-        ariaLabel="Preview"
-        contained
-      >
-        <MockContent />
-      </AttachmentLightbox>,
-    );
-    const dialog = document.querySelector('[role="dialog"]');
-    expect(dialog?.className).toContain("absolute");
-    expect(dialog?.className).not.toContain("fixed");
-  });
 });

 // ─── Focus management ─────────────────────────────────────────────────────────
@@ -1,19 +1,19 @@
 // @vitest-environment jsdom
 /**
- * AttachmentPDF — inline PDF preview button + click-to-panel lightbox.
+ * AttachmentPDF — inline PDF preview button + click-to-fullscreen lightbox.
 *
 * Per RFC #2991 PR-3: platform-auth URIs fetch bytes → Blob → ObjectURL;
 * external URIs use the raw URL directly. State machine: idle → loading →
 * ready/error. Loading skeleton shown while fetching. Error falls back to
 * AttachmentChip. Clicking the preview button opens AttachmentLightbox with
- * a browser PDF iframe. Blob URL cleaned up on unmount.
+ * <embed>. Blob URL cleaned up on unmount.
 *
 * NOTE: No @testing-library/jest-dom import — use DOM APIs for assertions.
 *
 * Covers:
 *   - Renders loading skeleton with PdfGlyph + filename text
 *   - Renders preview button with PDF glyph, filename, and "PDF" label
- *   - Opens lightbox with a framed <iframe> viewer on button click
+ *   - Opens lightbox with <embed> on button click
 *   - Lightbox closes on Escape
 *   - tone=user applies blue/accent classes on button
 *   - tone=agent applies neutral border on button
@@ -42,7 +42,7 @@ vi.mock("../uploads", () => ({
 }));

 vi.mock("@/lib/api", () => ({
-  platformAuthHeaders: () => ({ Authorization: "Bearer fixture-token" }),
+  platformAuthHeaders: () => ({ Authorization: "Bearer test-token" }),
 }));

 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -136,7 +136,7 @@ describe("AttachmentPDF — ready", () => {
    expect(btn?.textContent).toContain("PDF");
  });

-  it("opens lightbox with a framed iframe viewer on button click", async () => {
+  it("opens lightbox with <embed> on button click", async () => {
    mockFetchOk("data");
    const att = makeAttachment("report.pdf");
    render(
@@ -158,13 +158,8 @@ describe("AttachmentPDF — ready", () => {
    });
    const dialog = document.querySelector('[role="dialog"]');
    expect(dialog?.getAttribute("aria-label")).toContain("report.pdf");
-    expect(dialog?.className).toContain("absolute");
-    const frame = dialog?.querySelector("iframe") as HTMLIFrameElement | null;
-    expect(frame).toBeTruthy();
-    expect(frame?.getAttribute("title")).toBe("report.pdf");
-    expect(frame?.className).toContain("bg-white");
-    expect(frame?.parentElement?.className).toContain("w-full");
-    expect(dialog?.querySelector("embed")).toBeNull();
+    // Lightbox contains an <embed>
+    expect(dialog?.querySelector("embed")).toBeTruthy();
  });

  it("closes lightbox on Escape key", async () => {
@@ -16,7 +16,7 @@ afterEach(cleanup);

 // Mock the auth-token env var so AttachmentImage's fetch doesn't
 // hit a real network. The fetch is itself mocked below.
-vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "fixture-token");
+vi.stubEnv("NEXT_PUBLIC_ADMIN_TOKEN", "test-token");

 // Mock fetch so the AttachmentImage path can return a synthetic blob.
 // Tests override per-case to simulate success / 404 / network fail.
@@ -237,13 +237,11 @@ describe("AttachmentPreview dispatch", () => {
      expect(screen.getByLabelText(/Open doc\.pdf preview/i)).toBeTruthy();
    });

-    // Click → panel-contained lightbox opens with a browser PDF iframe.
+    // Click → lightbox opens with <embed> inside.
    fireEvent.click(screen.getByLabelText(/Open doc\.pdf preview/i));
    const dialog = await screen.findByRole("dialog");
    expect(dialog).toBeTruthy();
-    expect(dialog.className).toContain("absolute");
-    expect(dialog.querySelector("iframe")).not.toBeNull();
-    expect(dialog.querySelector("embed")).toBeNull();
+    expect(dialog.querySelector("embed[type='application/pdf']")).not.toBeNull();
  });

  it("kind=pdf fetch fails → falls back to chip", async () => {
@@ -44,7 +44,7 @@ vi.mock("../uploads", () => ({
 }));

 vi.mock("@/lib/api", () => ({
-  platformAuthHeaders: () => ({ Authorization: "Bearer fixture-token" }),
+  platformAuthHeaders: () => ({ Authorization: "Bearer test-token" }),
 }));

 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -43,7 +43,7 @@ vi.mock("../uploads", () => ({

 // Mock platformAuthHeaders so fetch gets auth headers
 vi.mock("@/lib/api", () => ({
-  platformAuthHeaders: () => ({ Authorization: "Bearer fixture-token" }),
+  platformAuthHeaders: () => ({ Authorization: "Bearer test-token" }),
 }));

 // ─── Helpers ──────────────────────────────────────────────────────────────────
@@ -113,31 +113,6 @@ describe("resolveAttachmentHref — platform-pending: scheme (poll-mode uploads)
  });
 });

-describe("resolveAttachmentHref — legacy platform content URLs", () => {
-  const chatWs = "chat-ws-aaaaaaaa";
-  const sourceWs = "d76977b1-d620-4f42-a57e-111111111111";
-  const fileID = "e2dfaf2e-1111-4abc-9999-222222222222";
-
-  it("rewrites /workspaces/<ws>/content/<file>/content to the authenticated pending-upload endpoint", () => {
-    const url = resolveAttachmentHref(
-      chatWs,
-      `/workspaces/${sourceWs}/content/${fileID}/content`,
-    );
-    expect(url).toContain(`/workspaces/${sourceWs}/pending-uploads/${fileID}/content`);
-    expect(url).not.toContain(`/workspaces/${chatWs}/`);
-  });
-
-  it("treats legacy content URLs as platform attachments so previews fetch with auth headers", () => {
-    expect(isPlatformAttachment(`/workspaces/${sourceWs}/content/${fileID}/content`)).toBe(true);
-  });
-
-  it("passes malformed legacy content URLs through unchanged", () => {
-    const malformed = `/workspaces/${sourceWs}/content//content`;
-    expect(resolveAttachmentHref(chatWs, malformed)).toBe(malformed);
-    expect(isPlatformAttachment(malformed)).toBe(false);
-  });
-});
-
 describe("isPlatformAttachment", () => {
  it("returns true for platform-pending: URIs", () => {
    expect(isPlatformAttachment("platform-pending:abc/file")).toBe(true);
@@ -125,8 +125,6 @@ export async function uploadChatFiles(
 *    - `/workspace/...` (bare absolute path inside the container)
 *    - `platform-pending:<wsid>/<file_id>` (poll-mode upload, staged
 *      on platform side; resolves to /pending-uploads/<file_id>/content)
- *    - `/workspaces/<wsid>/content/<file_id>/content` (legacy platform
- *      content URL; normalizes to the same pending-upload endpoint)
 *  Everything that looks like an allowed-root container path is
 *  rewritten to the authenticated /chat/download endpoint. HTTP(S)
 *  URIs pass through unchanged so we can also render links to
@@ -165,11 +163,6 @@ export function resolveAttachmentHref(
    }
    return uri;
  }
-  const legacy = parseLegacyPlatformContentUri(uri);
-  if (legacy) {
-    const [wsid, fileID] = legacy;
-    return `${PLATFORM_URL}/workspaces/${encodeURIComponent(wsid)}/pending-uploads/${encodeURIComponent(fileID)}/content`;
-  }
  const containerPath = normalizeWorkspaceUri(uri);
  if (containerPath) {
    return `${PLATFORM_URL}/workspaces/${workspaceId}/chat/download?path=${encodeURIComponent(containerPath)}`;
@@ -182,7 +175,6 @@ export function resolveAttachmentHref(
 *  downloadChatFile rather than letting the browser navigate. */
 export function isPlatformAttachment(uri: string): boolean {
  if (uri.startsWith("platform-pending:")) return true;
-  if (parseLegacyPlatformContentUri(uri)) return true;
  return normalizeWorkspaceUri(uri) !== null;
 }

@@ -191,12 +183,6 @@ export function isPlatformAttachment(uri: string): boolean {
 *  mirror the server's `allowedRoots` allowlist. */
 const ALLOWED_CONTAINER_ROOTS = ["/configs", "/workspace", "/home", "/plugins"];

-function parseLegacyPlatformContentUri(uri: string): [string, string] | null {
-  const m = uri.match(/^\/workspaces\/([^/]+)\/content\/([^/]+)\/content(?:[?#].*)?$/);
-  if (!m || !m[1] || !m[2]) return null;
-  return [m[1], m[2]];
-}
-
 function normalizeWorkspaceUri(uri: string): string | null {
  let path: string | null = null;
  if (uri.startsWith("workspace:")) {
@@ -63,7 +63,6 @@ vi.mock("@/components/MissingKeysModal", () => ({
    onKeysAdded: (model?: string) => void;
    onCancel: () => void;
    configuredKeys?: Set<string>;
-    optionalKeys?: string[];
    modelSuggestions?: string[];
    initialModel?: string;
    title?: string;
@@ -78,9 +77,6 @@ vi.mock("@/components/MissingKeysModal", () => ({
        </span>
        <span data-testid="modal-initial-model">{props.initialModel ?? ""}</span>
        <span data-testid="modal-title">{props.title ?? ""}</span>
-        <span data-testid="modal-optional-keys">
-          {(props.optionalKeys ?? []).join(",")}
-        </span>
        <button
          data-testid="modal-keys-added"
          onClick={() => props.onKeysAdded()}
@@ -117,7 +113,6 @@ function makeTemplate(over: Partial<Template> = {}): Template {
    runtime: "claude-code",
    models: [],
    required_env: [],
-    recommended_env: [],
    ...over,
  };
 }
@@ -134,7 +129,6 @@ beforeEach(() => {
    missingKeys: [],
    providers: [],
    runtime: "claude-code",
-    optionalKeys: [],
    configuredKeys: new Set(),
  });
  mockApiPost.mockResolvedValue({ id: "ws-new" });
@@ -149,30 +143,46 @@ afterEach(() => {

 // ── Tests ────────────────────────────────────────────────────────────────────

+/**
+ * Drive the always-show-picker flow to completion: deploy() opens the
+ * modal, then we click "keys added" to fire the actual POST. Centralised
+ * here because as of the always-prompt change, every happy-path test
+ * must click through the modal before asserting on POST.
+ */
+async function deployThroughPicker<T>(
+  result: { current: ReturnType<typeof useTemplateDeploy> },
+  rerender: () => void,
+  template: Template,
+): Promise<void> {
+  await act(async () => {
+    await result.current.deploy(template);
+  });
+  rerender();
+  render(<>{result.current.modal}</>);
+  await act(async () => {
+    fireEvent.click(screen.getByTestId("modal-keys-added"));
+    // Let the fire-and-forget executeDeploy resolve.
+    await Promise.resolve();
+    await Promise.resolve();
+  });
+}
+
 describe("useTemplateDeploy — happy path", () => {
-  it("preflight ok with no key requirements → POST /workspaces directly → onDeployed fires", async () => {
+  it("preflight ok → modal opens → keys-added → POST /workspaces → onDeployed fires", async () => {
    const onDeployed = vi.fn();
-    const { result } = renderHook(() =>
+    const { result, rerender } = renderHook(() =>
      useTemplateDeploy({ onDeployed }),
    );

-    await act(async () => {
-      await result.current.deploy(makeTemplate({
-        id: "seo-agent",
-        name: "SEO Agent",
-        model: "MiniMax-M2.7",
-      }));
-    });
+    await deployThroughPicker(result, rerender, makeTemplate());

    expect(mockCheckDeploySecrets).toHaveBeenCalledTimes(1);
    expect(mockApiPost).toHaveBeenCalledWith(
      "/workspaces",
      expect.objectContaining({
-        name: "SEO Agent",
-        template: "seo-agent",
+        name: "Claude Code",
+        template: "claude-code-default",
        tier: 1,
-        model: "MiniMax-M2.7",
-        llm_provider: "minimax",
      }),
    );
    expect(onDeployed).toHaveBeenCalledWith("ws-new");
@@ -182,13 +192,11 @@ describe("useTemplateDeploy — happy path", () => {

  it("uses caller-supplied canvasCoords when provided", async () => {
    const canvasCoords = vi.fn(() => ({ x: 42, y: 99 }));
-    const { result } = renderHook(() =>
+    const { result, rerender } = renderHook(() =>
      useTemplateDeploy({ canvasCoords }),
    );

-    await act(async () => {
-      await result.current.deploy(makeTemplate());
-    });
+    await deployThroughPicker(result, rerender, makeTemplate());

    expect(canvasCoords).toHaveBeenCalledTimes(1);
    expect(mockApiPost).toHaveBeenCalledWith(
@@ -198,11 +206,9 @@ describe("useTemplateDeploy — happy path", () => {
  });

  it("falls back to random coords inside [100,500] × [100,400] when canvasCoords omitted", async () => {
-    const { result } = renderHook(() => useTemplateDeploy());
+    const { result, rerender } = renderHook(() => useTemplateDeploy());

-    await act(async () => {
-      await result.current.deploy(makeTemplate());
-    });
+    await deployThroughPicker(result, rerender, makeTemplate());

    const body = (mockApiPost as Mock).mock.calls[0]?.[1] as {
      canvas: { x: number; y: number };
@@ -249,7 +255,6 @@ describe("useTemplateDeploy — preflight failure modes", () => {
      missingKeys: ["ANTHROPIC_API_KEY"],
      providers: [],
      runtime: "claude-code",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const onDeployed = vi.fn();
@@ -278,7 +283,6 @@ describe("useTemplateDeploy — modal lifecycle", () => {
      missingKeys: ["ANTHROPIC_API_KEY"],
      providers: [],
      runtime: "claude-code",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const onDeployed = vi.fn();
@@ -314,7 +318,6 @@ describe("useTemplateDeploy — modal lifecycle", () => {
      missingKeys: ["ANTHROPIC_API_KEY"],
      providers: [],
      runtime: "claude-code",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const { result, rerender } = renderHook(() => useTemplateDeploy());
@@ -368,7 +371,6 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
        { id: "ANTHROPIC_API_KEY", label: "Anthropic", envVars: ["ANTHROPIC_API_KEY"] },
      ],
      runtime: "hermes",
-      optionalKeys: [],
      configuredKeys: new Set(["MINIMAX_API_KEY", "ANTHROPIC_API_KEY"]),
    });
    const { result, rerender } = renderHook(() => useTemplateDeploy());
@@ -402,7 +404,6 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
        { id: "ANTHROPIC_API_KEY", label: "Anthropic", envVars: ["ANTHROPIC_API_KEY"] },
      ],
      runtime: "hermes",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const { result, rerender } = renderHook(() => useTemplateDeploy());
@@ -431,7 +432,6 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
        { id: "ANTHROPIC_API_KEY", label: "Anthropic", envVars: ["ANTHROPIC_API_KEY"] },
      ],
      runtime: "hermes",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const { result, rerender } = renderHook(() => useTemplateDeploy());
@@ -458,9 +458,16 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
    );
  });

-  it("template with no provider requirements deploys directly on platform-managed defaults", async () => {
+  it("single-provider template ALSO opens picker when preflight.ok (always-prompt rule)", async () => {
+    // Default preflight mock: ok=true, providers=[]. claude-code is
+    // single-provider, but the always-prompt rule means the user must
+    // still click through the picker to confirm provider+model — even
+    // when keys are saved and the runtime has only one provider option.
+    // Reason: the user needs an explicit chance to override the
+    // template's default model (e.g. opus vs sonnet vs haiku) before
+    // an EC2 boots and burns billing on the wrong tier.
    const onDeployed = vi.fn();
-    const { result } = renderHook(() =>
+    const { result, rerender } = renderHook(() =>
      useTemplateDeploy({ onDeployed }),
    );

@@ -468,18 +475,13 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
      await result.current.deploy(makeTemplate());
    });

+    rerender();
    render(<>{result.current.modal}</>);

-    expect(screen.queryByTestId("missing-keys-modal")).toBeNull();
-    expect(mockApiPost).toHaveBeenCalledWith(
-      "/workspaces",
-      expect.objectContaining({
-        template: "claude-code-default",
-        model: "claude-sonnet-4-5",
-        llm_provider: "anthropic",
-      }),
-    );
-    expect(onDeployed).toHaveBeenCalledWith("ws-new");
+    expect(screen.getByTestId("missing-keys-modal")).toBeTruthy();
+    // POST does NOT fire until the user confirms in the picker.
+    expect(mockApiPost).not.toHaveBeenCalled();
+    expect(onDeployed).not.toHaveBeenCalled();
    expect(result.current.deploying).toBeNull();
  });

@@ -496,7 +498,6 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
        { id: "ANTHROPIC_API_KEY", label: "Anthropic", envVars: ["ANTHROPIC_API_KEY"] },
      ],
      runtime: "hermes",
-      optionalKeys: [],
      configuredKeys: new Set(),
    });
    const { result, rerender } = renderHook(() => useTemplateDeploy());
@@ -512,48 +513,17 @@ describe("useTemplateDeploy — multi-provider always-ask flow", () => {
    expect(screen.getByTestId("modal-configured-size").textContent).toBe("0");
    expect(mockApiPost).not.toHaveBeenCalled();
  });
-
-  it("opens configure modal for optional env prompts even when no required provider key is missing", async () => {
-    mockCheckDeploySecrets.mockResolvedValueOnce({
-      ok: true,
-      missingKeys: [],
-      providers: [],
-      runtime: "claude-code",
-      optionalKeys: ["GOOGLE_GSC_SITE", "GOOGLE_GA4_PROPERTY_ID"],
-      configuredKeys: new Set(),
-    });
-    const { result, rerender } = renderHook(() => useTemplateDeploy());
-
-    await act(async () => {
-      await result.current.deploy(makeTemplate({
-        id: "seo-agent",
-        name: "SEO Agent",
-        recommended_env: ["GOOGLE_GSC_SITE", "GOOGLE_GA4_PROPERTY_ID"],
-      }));
-    });
-
-    rerender();
-    render(<>{result.current.modal}</>);
-
-    expect(screen.getByTestId("missing-keys-modal")).toBeTruthy();
-    expect(screen.getByTestId("modal-optional-keys").textContent).toBe(
-      "GOOGLE_GSC_SITE,GOOGLE_GA4_PROPERTY_ID",
-    );
-    expect(mockApiPost).not.toHaveBeenCalled();
-  });
 });

 describe("useTemplateDeploy — POST failure", () => {
  it("POST rejection sets error and clears deploying", async () => {
    mockApiPost.mockRejectedValueOnce(new Error("server 500"));
    const onDeployed = vi.fn();
-    const { result } = renderHook(() =>
+    const { result, rerender } = renderHook(() =>
      useTemplateDeploy({ onDeployed }),
    );

-    await act(async () => {
-      await result.current.deploy(makeTemplate());
-    });
+    await deployThroughPicker(result, rerender, makeTemplate());

    expect(result.current.error).toBe("server 500");
    expect(result.current.deploying).toBeNull();
@@ -562,11 +532,9 @@ describe("useTemplateDeploy — POST failure", () => {

  it("non-Error rejection still surfaces a message (defensive)", async () => {
    mockApiPost.mockRejectedValueOnce("plain string");
-    const { result } = renderHook(() => useTemplateDeploy());
+    const { result, rerender } = renderHook(() => useTemplateDeploy());

-    await act(async () => {
-      await result.current.deploy(makeTemplate());
-    });
+    await deployThroughPicker(result, rerender, makeTemplate());

    expect(result.current.error).toBe("Deploy failed");
    expect(result.current.deploying).toBeNull();
@@ -55,22 +55,6 @@ interface MissingKeysInfo {
  preflight: PreflightResult;
 }

-function nativeProviderForClaudeCodeModel(model: string): string | undefined {
-  const trimmed = model.trim();
-  const lower = trimmed.toLowerCase();
-  if (!trimmed) return undefined;
-  if (lower.startsWith("minimax")) return "minimax";
-  if (lower.startsWith("kimi")) return "kimi-coding";
-  if (lower.startsWith("claude")) return "anthropic";
-  if (/^(sonnet|opus|haiku)$/.test(lower)) return "anthropic-oauth";
-  return undefined;
-}
-
-function isNativeClaudeCodeRuntime(template: Template): boolean {
-  const runtime = template.runtime ?? resolveRuntime(template.id);
-  return runtime === "claude-code";
-}
-
 export interface UseTemplateDeployResult {
  /** Template id currently being deployed (incl. the preflight
   *  network call), or null when idle. Callers pass this to disable
@@ -113,10 +97,6 @@ export function useTemplateDeploy(
      setDeploying(template.id);
      setError(null);
      try {
-        const selectedModel = model?.trim() || template.model?.trim();
-        const nativeProvider = isNativeClaudeCodeRuntime(template) && selectedModel
-          ? nativeProviderForClaudeCodeModel(selectedModel)
-          : undefined;
        const coords = canvasCoords
          ? canvasCoords()
          : {
@@ -128,8 +108,7 @@ export function useTemplateDeploy(
          template: template.id,
          tier: isSaaSTenant() ? 4 : template.tier,
          canvas: coords,
-          ...(selectedModel ? { model: selectedModel } : {}),
-          ...(nativeProvider ? { llm_provider: nativeProvider } : {}),
+          ...(model ? { model } : {}),
        });
        onDeployed?.(ws.id);
      } catch (e) {
@@ -152,7 +131,6 @@ export function useTemplateDeploy(
          runtime,
          models: template.models,
          required_env: template.required_env,
-          recommended_env: template.recommended_env,
        });
      } catch (e) {
        // Preflight network failure used to strand `deploying` — the
@@ -166,17 +144,8 @@ export function useTemplateDeploy(
        setDeploying(null);
        return;
      }
-      if (
-        preflight.ok &&
-        preflight.providers.length === 0 &&
-        preflight.optionalKeys.length === 0
-      ) {
-        await executeDeploy(template);
-        return;
-      }
-      // Open the picker whenever a template declares provider/key choices.
-      // Templates with no provider requirements deploy directly on the
-      // platform-managed default above. Reasons to keep the picker here:
+      // Always open the picker — every deploy goes through an
+      // explicit confirm-provider/model step. Reasons:
      //   1. Multi-provider templates (e.g. hermes) need a per-
      //      workspace pick or the adapter falls back to its
      //      compiled-in default and 500s with "No LLM provider
@@ -195,7 +164,7 @@ export function useTemplateDeploy(
      setMissingKeysInfo({ template, preflight });
      setDeploying(null);
    },
-    [executeDeploy],
+    [],
  );

  // No useCallback here — consumers call this on every render anyway
@@ -225,7 +194,6 @@ export function useTemplateDeploy(
    <MissingKeysModal
      open={!!missingKeysInfo}
      missingKeys={missingKeysInfo?.preflight.missingKeys ?? []}
-      optionalKeys={missingKeysInfo?.preflight.optionalKeys ?? []}
      providers={missingKeysInfo?.preflight.providers ?? []}
      runtime={missingKeysInfo?.preflight.runtime ?? ""}
      configuredKeys={missingKeysInfo?.preflight.configuredKeys}
@@ -32,16 +32,11 @@ const hermesModels: ModelSpec[] = [

 const HERMES: TemplateLike = { runtime: "hermes", models: hermesModels };

-const CLAUDE_CODE: TemplateLike = {
-  runtime: "claude-code",
+const LANGGRAPH: TemplateLike = {
+  runtime: "langgraph",
  required_env: ["OPENAI_API_KEY"],
 };

-const OPTIONAL_ONLY: TemplateLike = {
-  runtime: "claude-code",
-  recommended_env: ["GOOGLE_GSC_SITE", "GOOGLE_GA4_PROPERTY_ID"],
-};
-
 const UNKNOWN: TemplateLike = { runtime: "nothing-declared" };

 // -----------------------------------------------------------------------------
@@ -74,7 +69,7 @@ describe("providersFromTemplate", () => {
  });

  it("falls back to top-level required_env when no models[] are declared", () => {
-    const providers = providersFromTemplate(CLAUDE_CODE);
+    const providers = providersFromTemplate(LANGGRAPH);
    expect(providers).toHaveLength(1);
    expect(providers[0].envVars).toEqual(["OPENAI_API_KEY"]);
  });
@@ -156,11 +151,10 @@ describe("checkDeploySecrets", () => {
        ]),
    } as Response);

-    const result = await checkDeploySecrets(CLAUDE_CODE);
+    const result = await checkDeploySecrets(LANGGRAPH);
    expect(result.ok).toBe(true);
    expect(result.missingKeys).toEqual([]);
-    expect(result.optionalKeys).toEqual([]);
-    expect(result.runtime).toBe("claude-code");
+    expect(result.runtime).toBe("langgraph");
  });

  it("returns ok=true on a multi-provider template when ANY provider is configured", async () => {
@@ -190,7 +184,6 @@ describe("checkDeploySecrets", () => {
    );
    // Grouped providers preserved for the picker.
    expect(result.providers).toHaveLength(3);
-    expect(result.optionalKeys).toEqual([]);
  });

  it("treats has_value=false as not-configured", async () => {
@@ -202,7 +195,7 @@ describe("checkDeploySecrets", () => {
        ]),
    } as Response);

-    const result = await checkDeploySecrets(CLAUDE_CODE);
+    const result = await checkDeploySecrets(LANGGRAPH);
    expect(result.ok).toBe(false);
    expect(result.missingKeys).toEqual(["OPENAI_API_KEY"]);
  });
@@ -214,22 +207,6 @@ describe("checkDeploySecrets", () => {
    expect(global.fetch).not.toHaveBeenCalled();
  });

-  it("prompts optional-only env without treating it as missing", async () => {
-    (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
-      ok: true,
-      json: () => Promise.resolve([]),
-    } as Response);
-
-    const result = await checkDeploySecrets(OPTIONAL_ONLY);
-    expect(result.ok).toBe(true);
-    expect(result.missingKeys).toEqual([]);
-    expect(result.optionalKeys).toEqual([
-      "GOOGLE_GSC_SITE",
-      "GOOGLE_GA4_PROPERTY_ID",
-    ]);
-    expect(global.fetch).toHaveBeenCalled();
-  });
-
  it("uses the workspace-scoped endpoint when workspaceId is provided", async () => {
    (global.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce({
      ok: true,
@@ -239,7 +216,7 @@ describe("checkDeploySecrets", () => {
        ]),
    } as Response);

-    await checkDeploySecrets(CLAUDE_CODE, "ws-123");
+    await checkDeploySecrets(LANGGRAPH, "ws-123");
    expect(global.fetch).toHaveBeenCalledWith(
      expect.stringContaining("/workspaces/ws-123/secrets"),
      expect.any(Object),
@@ -252,7 +229,7 @@ describe("checkDeploySecrets", () => {
      json: () => Promise.resolve([]),
    } as Response);

-    await checkDeploySecrets(CLAUDE_CODE);
+    await checkDeploySecrets(LANGGRAPH);
    expect(global.fetch).toHaveBeenCalledWith(
      expect.stringContaining("/settings/secrets"),
      expect.any(Object),
@@ -264,10 +241,9 @@ describe("checkDeploySecrets", () => {
      new Error("Network error"),
    );

-    const result = await checkDeploySecrets(CLAUDE_CODE);
+    const result = await checkDeploySecrets(LANGGRAPH);
    expect(result.ok).toBe(false);
    expect(result.missingKeys).toEqual(["OPENAI_API_KEY"]);
-    expect(result.optionalKeys).toEqual([]);
    // Empty Set on fetch failure — useTemplateDeploy relies on this
    // so the picker still opens with every entry rendered as input.
    expect(result.configuredKeys).toEqual(new Set());
@@ -28,8 +28,8 @@ describe("isExternalLikeRuntime", () => {
      "docker",
      "local",
      "agent",
-      "legacy-runtime",
-      "codex",
+      "crewai",
+      "langgraph",
      "openclaw",
      "custom-runtime",
    ])("%q returns false", (runtime) => {
@@ -8,39 +8,51 @@
 * count bounded.
 */
 import { describe, it, expect } from "vitest";
-import { isUserVisibleWorkspaceTemplate, resolveRuntime } from "../deploy-preflight";
+import { resolveRuntime } from "../deploy-preflight";

 describe("resolveRuntime", () => {
  describe("explicit runtime-map entries", () => {
+    it('maps "langgraph" to "langgraph"', () => {
+      expect(resolveRuntime("langgraph")).toBe("langgraph");
+    });
+
    it('maps "claude-code-default" to "claude-code"', () => {
      expect(resolveRuntime("claude-code-default")).toBe("claude-code");
    });

-    it('maps "codex" to "codex"', () => {
-      expect(resolveRuntime("codex")).toBe("codex");
-    });
-
-    it('maps "hermes" to "hermes"', () => {
-      expect(resolveRuntime("hermes")).toBe("hermes");
-    });
-
    it('maps "openclaw" to "openclaw"', () => {
      expect(resolveRuntime("openclaw")).toBe("openclaw");
    });
+
+    it('maps "deepagents" to "deepagents"', () => {
+      expect(resolveRuntime("deepagents")).toBe("deepagents");
+    });
+
+    it('maps "crewai" to "crewai"', () => {
+      expect(resolveRuntime("crewai")).toBe("crewai");
+    });
+
+    it('maps "autogen" to "autogen"', () => {
+      expect(resolveRuntime("autogen")).toBe("autogen");
+    });
  });

  describe("identity fallback for modern template ids", () => {
+    it("returns the id unchanged when not in the map", () => {
+      expect(resolveRuntime("hermes")).toBe("hermes");
+    });
+
    it("strips trailing -default suffix as fallback", () => {
      expect(resolveRuntime("hermes-default")).toBe("hermes");
    });

    it("strips -default only when it is the suffix", () => {
      // "default-something" should NOT strip
-      expect(resolveRuntime("default-custom")).toBe("default-custom");
+      expect(resolveRuntime("default-langgraph")).toBe("default-langgraph");
    });

    it("returns the id unchanged when id has no -default suffix", () => {
-      expect(resolveRuntime("custom-runtime")).toBe("custom-runtime");
+      expect(resolveRuntime("gemini-cli")).toBe("gemini-cli");
    });

    it("handles custom template ids from community templates", () => {
@@ -64,15 +76,3 @@ describe("resolveRuntime", () => {
    });
  });
 });
-
-describe("isUserVisibleWorkspaceTemplate", () => {
-  it("hides runtime-default templates from product template surfaces", () => {
-    for (const id of ["claude-code-default", "codex", "hermes", "openclaw"]) {
-      expect(isUserVisibleWorkspaceTemplate({ id })).toBe(false);
-    }
-  });
-
-  it("keeps product templates visible", () => {
-    expect(isUserVisibleWorkspaceTemplate({ id: "seo-agent" })).toBe(true);
-  });
-});
@@ -13,9 +13,11 @@ import { runtimeDisplayName } from "../runtime-names";
 describe("runtimeDisplayName", () => {
  it.each([
    ["claude-code", "Claude Code"],
-    ["codex", "Codex"],
-    ["hermes", "Hermes"],
+    ["langgraph", "LangGraph"],
+    ["deepagents", "DeepAgents"],
    ["openclaw", "OpenClaw"],
+    ["crewai", "CrewAI"],
+    ["autogen", "AutoGen"],
  ])("known runtime %q maps to %q", (input, expected) => {
    expect(runtimeDisplayName(input)).toBe(expected);
  });
@@ -23,6 +25,7 @@ describe("runtimeDisplayName", () => {
  it("unknown runtime falls back to the input string verbatim", () => {
    // A future runtime not yet in the lookup map should render with
    // its own id — better than a generic placeholder for ops debugging.
+    expect(runtimeDisplayName("hermes")).toBe("hermes");
    expect(runtimeDisplayName("custom-runtime-9000")).toBe(
      "custom-runtime-9000",
    );
@@ -40,6 +43,6 @@ describe("runtimeDisplayName", () => {
    // the input "for safety" doesn't silently change behavior — the
    // upstream slug is already normalized lowercase.
    expect(runtimeDisplayName("Claude-Code")).toBe("Claude-Code");
-    expect(runtimeDisplayName("CODEX")).toBe("CODEX");
+    expect(runtimeDisplayName("LANGGRAPH")).toBe("LANGGRAPH");
  });
 });
@@ -68,7 +68,8 @@ describe("provisionTimeoutForRuntime", () => {
  });

  it("returns 120_000 for any unknown runtime", () => {
-    expect(provisionTimeoutForRuntime("legacy-runtime")).toBe(120_000);
+    expect(provisionTimeoutForRuntime("langgraph")).toBe(120_000);
+    expect(provisionTimeoutForRuntime("crewai")).toBe(120_000);
    expect(provisionTimeoutForRuntime("some-new-runtime")).toBe(120_000);
  });

@@ -76,7 +77,7 @@ describe("provisionTimeoutForRuntime", () => {
    const cases: Array<[string | undefined, { provisionTimeoutMs?: number } | undefined]> = [
      [undefined, undefined],
      ["claude-code", undefined],
-      ["claude-code", { provisionTimeoutMs: 500_000 }],
+      ["langgraph", { provisionTimeoutMs: 500_000 }],
      [undefined, { provisionTimeoutMs: 45_000 }],
    ];
    for (const [runtime, overrides] of cases) {
@@ -23,7 +23,6 @@ const DEFAULT_TIMEOUT_MS = 35_000;

 export interface RequestOptions {
  timeoutMs?: number;
-  headers?: Record<string, string>;
 }

 /**
@@ -77,7 +76,6 @@ async function request<T>(
  const headers: Record<string, string> = {
    "Content-Type": "application/json",
    ...platformAuthHeaders(),
-    ...(options?.headers ?? {}),
  };
  // Re-read slug locally for the 401 handler below — `headers` already
  // has it, but the 401 branch needs the bare value to gate the
@@ -44,7 +44,7 @@ export const plans: Plan[] = [
    price: "$0",
    features: [
      "3 workspaces",
-      "Claude Code, Codex, Hermes, OpenClaw runtimes",
+      "Claude Code, LangGraph, OpenClaw runtimes",
      "Shared Redis + bounded storage",
      "Community support",
    ],
@@ -21,7 +21,6 @@ import { api } from "./api";
 export interface ModelSpec {
  id: string;
  name?: string;
-  provider?: string;
  required_env?: string[];
 }

@@ -32,8 +31,6 @@ export interface TemplateLike {
  models?: ModelSpec[];
  /** AND-required env vars declared at runtime_config level. */
  required_env?: string[];
-  /** Optional env vars declared at runtime_config level. */
-  recommended_env?: string[];
 }

 /** Full /templates response shape shared by TemplatePalette (sidebar)
@@ -52,17 +49,6 @@ export interface Template extends TemplateLike {
  skill_count: number;
 }

-const RUNTIME_DEFAULT_TEMPLATE_IDS = new Set([
-  "claude-code-default",
-  "codex",
-  "hermes",
-  "openclaw",
-]);
-
-export function isUserVisibleWorkspaceTemplate(template: Pick<Template, "id">): boolean {
-  return !RUNTIME_DEFAULT_TEMPLATE_IDS.has(template.id);
-}
-
 /** Map from a template id to the runtime name the per-workspace
 *  preflight expects. Used only when the server's `/templates`
 *  response predates the `runtime` field on the summary (legacy
@@ -77,10 +63,12 @@ export function isUserVisibleWorkspaceTemplate(template: Pick<Template, "id">):
 *  id needs a non-identity mapping. */
 export function resolveRuntime(templateId: string): string {
  const runtimeMap: Record<string, string> = {
+    langgraph: "langgraph",
    "claude-code-default": "claude-code",
-    codex: "codex",
-    hermes: "hermes",
    openclaw: "openclaw",
+    deepagents: "deepagents",
+    crewai: "crewai",
+    autogen: "autogen",
  };
  return runtimeMap[templateId] ?? templateId.replace(/-default$/, "");
 }
@@ -98,8 +86,6 @@ export interface PreflightResult {
  /** Flat list of env var names needed — for the legacy modal path and
   *  for callers that want a single display of "what's missing". */
  missingKeys: string[];
-  /** Optional env vars to offer in the modal without blocking deploy. */
-  optionalKeys: string[];
  /** Grouped provider options derived from the template. When length ≥ 2
   *  the modal renders a picker; length 1 means exactly one provider is
   *  required (AllKeysModal renders the N envVars inline). */
@@ -252,14 +238,12 @@ export async function checkDeploySecrets(
 ): Promise<PreflightResult> {
  const providers = providersFromTemplate(template);
  const runtime = template.runtime;
-  const optionalKeys = Array.from(new Set(template.recommended_env ?? []));

-  if (providers.length === 0 && optionalKeys.length === 0) {
+  if (providers.length === 0) {
    // Template declares no env requirements — nothing to preflight.
    return {
      ok: true,
      missingKeys: [],
-      optionalKeys: [],
      providers: [],
      runtime,
      configuredKeys: new Set(),
@@ -281,11 +265,10 @@ export async function checkDeploySecrets(
    configured = new Set();
  }

-  if (providers.length === 0 || findSatisfiedProvider(providers, configured)) {
+  if (findSatisfiedProvider(providers, configured)) {
    return {
      ok: true,
      missingKeys: [],
-      optionalKeys,
      providers,
      runtime,
      configuredKeys: configured,
@@ -300,7 +283,6 @@ export async function checkDeploySecrets(
  return {
    ok: false,
    missingKeys,
-    optionalKeys,
    providers,
    runtime,
    configuredKeys: configured,
@@ -4,9 +4,11 @@

 const RUNTIME_NAMES: Record<string, string> = {
  "claude-code": "Claude Code",
-  codex: "Codex",
-  hermes: "Hermes",
+  langgraph: "LangGraph",
+  deepagents: "DeepAgents",
  openclaw: "OpenClaw",
+  crewai: "CrewAI",
+  autogen: "AutoGen",
  kimi: "Kimi",
  "kimi-cli": "Kimi CLI",
 };
@@ -49,7 +49,7 @@ export interface RuntimeProfile {
 }

 /** The floor every runtime inherits unless it overrides. Calibrated for
- *  docker-local fast runtimes (claude-code, codex, openclaw) where cold
+ *  docker-local fast runtimes (claude-code, langgraph, crewai) where cold
 *  boot is 30-90s. */
 export const DEFAULT_RUNTIME_PROFILE: Required<
  Pick<RuntimeProfile, "provisionTimeoutMs">
@@ -12,9 +12,7 @@ import type { NextRequest } from "next/server";
 *   • style-src retains 'unsafe-inline': React Flow positions nodes via
 *     element-level style="" attributes which cannot be nonce'd; CSS injection
 *     is significantly lower risk than script injection and is acceptable here.
- *   • object-src locked to 'none'; frame-src allows self + blob: for
- *     browser-native PDF previews backed by authenticated Blob URLs.
- *   • base-uri / frame-ancestors locked to 'self'/'none'.
+ *   • object-src / base-uri / frame-ancestors locked to 'none'/'self'.
 *   • upgrade-insecure-requests forces HTTPS on mixed-content.
 *
 * Development — permissive policy:
@@ -63,7 +61,6 @@ export function buildCsp(nonce: string, isDev: boolean): string {
    "img-src 'self' blob: data:",
    "font-src 'self'",
    "object-src 'none'",
-    "frame-src 'self' blob:",
    "base-uri 'self'",
    "form-action 'self'",
    "frame-ancestors 'none'",
@@ -528,7 +528,6 @@ export function buildNodesAndEdges(
        // A2A delivery mode (task #227). Absent on older ws-server builds
        // — leave undefined so the chat UI's "?? 'push'" fallback applies.
        deliveryMode: ws.delivery_mode,
-        compute: ws.compute,
      },
    };
    if (hasParent) {
@@ -7,7 +7,7 @@ import {
 } from "@xyflow/react";
 import { api } from "@/lib/api";
 import { showToast } from "@/components/Toaster";
-import type { WorkspaceCompute, WorkspaceData, WSMessage } from "./socket";
+import type { WorkspaceData, WSMessage } from "./socket";
 import { handleCanvasEvent } from "./canvas-events";
 import { markDeleted, wasRecentlyDeleted } from "./deleteTombstones";
 import {
@@ -130,14 +130,6 @@ export interface WorkspaceNodeData extends Record<string, unknown> {
   *  builds — that fallthrough is treated as "push" to match
   *  ws-server's `lookupDeliveryMode` default. */
  deliveryMode?: string;
-  /** Desired EC2/container shape persisted in workspaces.compute. Applied
-   *  at next restart/reprovision, and used to determine Display tab
-   *  availability. */
-  compute?: WorkspaceCompute;
-  /** Runtime image changed through Container Config; next restart must
-   *  re-apply the runtime-default template instead of reusing the old
-   *  config volume. UI-only, cleared after restart. */
-  applyTemplateOnRestart?: boolean;
 }

 export type PanelTab = "details" | "skills" | "chat" | "terminal" | "display" | "container-config" | "config" | "schedule" | "channels" | "files" | "memory" | "traces" | "events" | "activity" | "audit";
@@ -176,7 +168,7 @@ interface CanvasState {
  setPanelTab: (tab: PanelTab) => void;
  getSelectedNode: () => Node<WorkspaceNodeData> | null;
  updateNodeData: (id: string, data: Partial<WorkspaceNodeData>) => void;
-  restartWorkspace: (id: string, options?: { applyTemplate?: boolean }) => Promise<void>;
+  restartWorkspace: (id: string) => Promise<void>;
  removeNode: (id: string) => void;
  /** Remove a node AND every descendant in one atomic update. Mirrors
   *  the server-side cascade — `DELETE /workspaces/:id?confirm=true`
@@ -337,11 +329,8 @@ export const useCanvasStore = create<CanvasState>((set, get) => ({
  },
  batchDelete: async () => {
    const ids = Array.from(get().selectedNodeIds);
-    const names = new Map(get().nodes.map((node) => [node.id, node.data.name]));
    const results = await Promise.allSettled(
-      ids.map((id) => api.del(`/workspaces/${id}`, {
-        headers: { "X-Confirm-Name": names.get(id) ?? "" },
-      }))
+      ids.map((id) => api.del(`/workspaces/${id}`))
    );
    const failed: string[] = [];
    results.forEach((r, i) => {
@@ -832,10 +821,9 @@ export const useCanvasStore = create<CanvasState>((set, get) => ({
    });
  },

-  restartWorkspace: async (id, options) => {
-    const body = options?.applyTemplate ? { apply_template: true } : undefined;
-    await api.post(`/workspaces/${id}/restart`, body);
-    get().updateNodeData(id, { needsRestart: false, applyTemplateOnRestart: false });
+  restartWorkspace: async (id) => {
+    await api.post(`/workspaces/${id}/restart`);
+    get().updateNodeData(id, { needsRestart: false });
  },

  removeNode: (id) => {
@@ -354,20 +354,6 @@ export interface WorkspaceData {
   *  collapsing the spinner the moment the synchronous queued-200 returns
   *  (task #227 — external/MCP workspaces had no progress UX). */
  delivery_mode?: string;
-  compute?: WorkspaceCompute;
-}
-
-export interface WorkspaceCompute {
-  instance_type?: string;
-  volume?: {
-    root_gb?: number;
-  };
-  display?: {
-    mode?: string;
-    protocol?: string;
-    width?: number;
-    height?: number;
-  };
 }

 let socket: ReconnectingSocket | null = null;
@@ -1,9 +0,0 @@
-declare module "@novnc/novnc" {
-  export default class RFB extends EventTarget {
-    scaleViewport: boolean;
-    resizeSession: boolean;
-    focusOnClick: boolean;
-    constructor(target: HTMLElement, url: string, options?: { wsProtocols?: string[]; [key: string]: unknown });
-    disconnect(): void;
-  }
-}
@@ -27,7 +27,7 @@ of the following:

 | Endpoint | Impact |
 |----------|--------|
-| `POST /admin/workspaces/:id/tokens` | Mint a fresh real bearer token for any workspace |
+| `GET /admin/workspaces/:id/test-token` | Mint a fresh bearer token for any workspace |
 | `DELETE /workspaces/:id` | Delete any workspace and auto-revoke its tokens |
 | `PUT /settings/secrets` / `POST /admin/secrets` | Overwrite any global secret (env-poisons every agent on restart) |
 | `DELETE /settings/secrets/:key` / `DELETE /admin/secrets/:key` | Delete any global secret; same fan-out restart |
@@ -68,9 +68,8 @@ malicious workspace with a pre-configured `initial_prompt` and elevated secrets.
 - **`ValidateAnyToken` removed-workspace JOIN** — tokens belonging to deleted
  workspaces are filtered at the DB layer (PR #682 defense-in-depth) so
  post-deletion token replay is blocked.
- **Production token mint route** — production and staging automation use
-  `POST /admin/workspaces/:id/tokens`; development-only shortcuts are not part
-  of the production contract.
+- **`MOLECULE_ENV=production` gate** — hides the `/admin/workspaces/:id/test-token`
+  endpoint in production deployments unless `MOLECULE_ENABLE_TEST_TOKENS=1`.

 ## Phase-H remediation plan

@@ -2,14 +2,14 @@

 ## Overview

-The workspace runtime uses a **pluggable adapter architecture** — each maintained agent infrastructure (Claude Code, Codex, Hermes, OpenClaw) has its own adapter that bridges the A2A protocol to the infra's native interface.
+The workspace runtime uses a **pluggable adapter architecture** — each agent infrastructure (Claude Code, OpenClaw, LangGraph, CrewAI, AutoGen, etc.) has its own adapter that bridges the A2A protocol to the infra's native interface.

 Adapters live in `workspace/adapters/<runtime>/` and are auto-discovered at startup. Each adapter implements `BaseAdapter` (from `adapters/base.py`) with `setup()` and `create_executor()` methods.

 The runtime is selected via `config.yaml`:

 ```yaml
-runtime: claude-code    # or: codex, hermes, openclaw
+runtime: claude-code    # or: langgraph, openclaw, deepagents, crewai, autogen
 runtime_config:
  model: sonnet
  auth_token_file: .auth-token
@@ -18,7 +18,7 @@ runtime_config:

 ## How It Works

-The unified runtime checks the `runtime` field in `config.yaml`, discovers the matching adapter, calls `adapter.setup(config)` then `adapter.create_executor(config)` to get an `AgentExecutor` that handles A2A requests.
+The unified `workspace-template` Docker image includes both Python (LangGraph) and Node.js (CLI runtimes). At startup, `main.py` checks the `runtime` field in `config.yaml`, discovers the matching adapter in `adapters/<runtime>/`, calls `adapter.setup(config)` then `adapter.create_executor(config)` to get an `AgentExecutor` that handles A2A requests.

 ```
 A2A request arrives
@@ -28,7 +28,7 @@ AgentExecutor.execute(context, event_queue)
      |  - extracts user message from A2A parts
      |  - extracts conversation history from params.metadata.history
      |  - sets current_task on heartbeat (shows on canvas card)
-      |  - invokes the runtime adapter
+      |  - invokes the runtime (LangGraph graph, CLI subprocess, etc.)
      v
 Response → A2A event queue → JSON-RPC response
 ```
@@ -37,9 +37,9 @@ Response → A2A event queue → JSON-RPC response

 Chat sessions in the Canvas UI send prior messages (up to 20) via `params.metadata.history` in each A2A `message/send` request. Executors extract this history:

+- **LangGraph/DeepAgents**: Prepends history as `("human", text)` / `("ai", text)` tuples to the LangGraph message list
+- **CrewAI/AutoGen**: Prepends history as a text prefix in the task description (`"Conversation so far:\n..."`)
 - **Claude Code**: Uses `--resume <session_id>` for native session continuity (history not needed)
- **Codex**: Uses the Codex runtime's native session state
- **Hermes**: Uses Hermes' agent runtime session handling
 - **OpenClaw**: Uses `--session-id` for native session continuity

 ### Current Task Reporting
@@ -48,6 +48,10 @@ All executors update the workspace's `current_task` via the heartbeat during exe

 ## Built-in Adapters

+### LangGraph (`runtime: langgraph`) — Default
+
+Full Python agent with LangGraph ReAct pattern. Supports skills, tools, plugins, peer coordination, and team routing.
+
 ### Claude Code (`runtime: claude-code`)

 ```yaml
@@ -67,18 +71,35 @@ The SDK uses the same Claude Code engine under the hood — plugins, CLAUDE.md d

 **Important:** Claude Code refuses to run as root with `--dangerously-skip-permissions`. The Dockerfile creates a non-root `agent` user.

-### Codex (`runtime: codex`)
+### CrewAI (`runtime: crewai`)
+
+Role-based multi-agent framework. Creates a CrewAI Agent + Task + Crew per request with A2A delegation tools (`delegate_to_peer`, `list_available_peers`).

 ```yaml
-runtime: codex
-model: openai/gpt-5.3-codex
+runtime: crewai
+model: openrouter:google/gemini-2.5-flash
 ```

-### Hermes (`runtime: hermes`)
+**Auth:** Uses `OPENROUTER_API_KEY` or `OPENAI_API_KEY` env var.
+
+### AutoGen (`runtime: autogen`)
+
+Microsoft AutoGen AssistantAgent with tool use. Creates an `AssistantAgent` per request with A2A delegation tools.

 ```yaml
-runtime: hermes
-model: openai/gpt-4o
+runtime: autogen
+model: openai:gpt-4.1-mini
+```
+
+**Auth:** Uses `OPENAI_API_KEY` env var.
+
+### DeepAgents (`runtime: deepagents`)
+
+LangGraph-based agent with deep planning capabilities. Uses the same `LangGraphA2AExecutor` as the default runtime but with a specialized agent setup including delegation, memory, and search tools.
+
+```yaml
+runtime: deepagents
+model: openrouter:google/gemini-2.5-flash
 ```

 ### OpenClaw (`runtime: openclaw`)
@@ -198,9 +219,9 @@ a2a info                           # Show workspace info

 Both approaches use the same backend: platform registry for discovery, A2A protocol for messaging, and access control enforcement (parent↔child, siblings only).

-## Memory Tools
+## Workspace Awareness

-CLI runtimes keep the same memory tool surface as the Python runtime: `commit_memory` / `commit_memory_v2` / `search_memory` / `commit_summary` / `forget_memory` are exposed via the workspace's MCP bridge and route through the platform's v2 memory plugin under the workspace's `workspace:<id>` namespace. See [Memory Architecture](../architecture/memory.md) for the backend.
+CLI runtimes keep the same memory tool surface as the Python runtime. When `AWARENESS_URL` and `AWARENESS_NAMESPACE` are injected into the workspace, `commit_memory` and `search_memory` route to the workspace's own awareness namespace instead of the fallback platform memory API. This keeps the agent contract stable while giving each workspace an isolated memory scope.

 ## Task Status Reporting

@@ -103,6 +103,8 @@ env:
  required:
    - ANTHROPIC_API_KEY
  optional:
+    - AWARENESS_URL
+    - AWARENESS_NAMESPACE
    - ANTHROPIC_BASE_URL
    - OPENAI_BASE_URL
    - GSC_CLIENT_ID
@@ -4,11 +4,13 @@ The `workspace/` directory is Molecule AI's unified runtime image. Every provisi

 ## Runtime Matrix In Current `main`

-Current `main` ships four maintained adapters:
+Current `main` ships six adapters:

+- `langgraph`
+- `deepagents`
 - `claude-code`
- `codex`
- `hermes`
+- `crewai`
+- `autogen`
 - `openclaw`

 This is the merged runtime surface today. Branch-level experiments such as NemoClaw are separate and should be treated as roadmap/WIP, not merged support.
@@ -25,7 +27,7 @@ Adapter-specific behavior is documented in [Agent Runtime Adapters](./cli-runtim
 - serving A2A over HTTP
 - registering with the platform and sending heartbeats
 - reporting activity and task state
- proxying durable memory tools through the v2 memory plugin
+- integrating with awareness-backed memory when configured
 - hot-reloading skills while the workspace is running

 ## Environment Model
@@ -37,6 +39,8 @@ WORKSPACE_ID=ws-123
 WORKSPACE_CONFIG_PATH=/configs
 PLATFORM_URL=http://platform:8080
 PARENT_ID=
+AWARENESS_URL=http://awareness:37800
+AWARENESS_NAMESPACE=workspace:ws-123
 LANGFUSE_HOST=http://langfuse-web:3000
 LANGFUSE_PUBLIC_KEY=...
 LANGFUSE_SECRET_KEY=...
@@ -45,7 +49,8 @@ LANGFUSE_SECRET_KEY=...
 Important behavior:

 - `WORKSPACE_CONFIG_PATH` points at the mounted config directory for that workspace.
- Memory MCP tools route through the platform's v2 memory plugin (see Memory Architecture doc); there is no per-workspace memory env var anymore — the plugin sidecar is provisioned at the tenant EC2 boundary.
+- `AWARENESS_URL` + `AWARENESS_NAMESPACE` enable workspace-scoped awareness-backed memory.
+- If awareness is absent, runtime memory tools fall back to the platform memory endpoints for compatibility.

 ## Startup Sequence

@@ -77,7 +82,8 @@ At a high level, `workspace/main.py` does this:
 | `skills/loader.py` | Parses `SKILL.md`, loads tool modules, returns loaded skill metadata |
 | `skills/watcher.py` | Hot reload path for skill changes |
 | `plugins.py` | Scans mounted plugins for shared rules, prompt fragments, and extra skills |
-| `tools/memory.py` | Agent memory tools (route through the platform's v2 memory plugin via the workspace-server proxy) |
+| `tools/memory.py` | Agent memory tools |
+| `tools/awareness_client.py` | Awareness-backed persistence wrapper |
 | `coordinator.py` | Coordinator-only delegation path for team leads |

 ## Skills, Plugins, And Hot Reload
@@ -97,28 +103,23 @@ Hot reload matters because the runtime is designed to keep a workspace alive whi

 The watcher rescans the skill package, rebuilds the agent tool surface, and updates the Agent Card so peers and the canvas reflect the new capabilities.

-## Memory Integration
+## Awareness And Memory Integration

 The runtime keeps the agent-facing contract stable:

- `commit_memory(content, scope)` — legacy MCP name, routed through the
-  v2 plugin's scope→namespace shim
- `commit_memory_v2(content, namespace)` — direct v2 surface
- `search_memory(query, namespace?)` — v2 plugin search with FTS +
-  semantic scoring when the plugin declares the capability
+- `commit_memory(content, scope)`
+- `search_memory(query, scope)`

-All writes land in the workspace's `workspace:<workspace_id>` namespace
-unless the agent passes an explicit one. Cross-workspace namespaces
-(`team:<root>`, `org:<root>`) follow the platform's namespace ACL
-(`internal/memory/namespace/resolver.go`). There is no per-workspace
-memory env var on the runtime side — the plugin lives on the tenant
-EC2 at `localhost:9100`, spawned by `entrypoint-tenant.sh` when
-`MEMORY_PLUGIN_URL` is present in the tenant-server's env (CP
-user-data injects it during tenant provisioning). The workspace-server
-proxies all memory calls through that sidecar.
+When awareness is configured:

-See [Memory Architecture](../architecture/memory.md) for the full
-backend story.
+- the tools route durable facts to the workspace's own awareness namespace
+- the namespace defaults to `workspace:<workspace_id>` unless explicitly overridden
+
+When awareness is not configured:
+
+- the same tools fall back to the platform memory endpoints
+
+That design lets the platform improve the backend memory boundary without forcing every agent prompt or tool signature to change.

 ## Coordinator Enforcement

@@ -26,7 +26,7 @@ Full contract: `docs/runbooks/admin-auth.md`.
 |--------|------|---------|
 | GET | /health | inline |
 | GET | /metrics | metrics.Handler() — Prometheus text format; no auth, scrape-safe |
-| POST/GET/PATCH/DELETE | /workspaces[/:id] | workspace.go — `GET /workspaces`, `POST /workspaces`, and `DELETE /workspaces/:id` require `AdminAuth`. `DELETE /workspaces/:id` also requires `X-Confirm-Name: <workspace name>`; cascading deletes still require `?confirm=true`. `PATCH /workspaces/:id` enforces field-level authz: cosmetic fields (name, role, x, y, canvas) pass through; sensitive fields (tier, parent_id, runtime, workspace_dir) require a valid bearer token when any live token exists. |
+| POST/GET/PATCH/DELETE | /workspaces[/:id] | workspace.go — `GET /workspaces`, `POST /workspaces`, and `DELETE /workspaces/:id` require `AdminAuth`. `PATCH /workspaces/:id` enforces field-level authz: cosmetic fields (name, role, x, y, canvas) pass through; sensitive fields (tier, parent_id, runtime, workspace_dir) require a valid bearer token when any live token exists. |
 | GET/PATCH | /workspaces/:id/config | workspace.go |
 | GET/POST | /workspaces/:id/memory | workspace.go |
 | DELETE | /workspaces/:id/memory/:key | workspace.go |
@@ -38,7 +38,7 @@ Full contract: `docs/runbooks/admin-auth.md`.
 | GET | /settings/secrets | secrets.go — list global secrets (keys only, values masked) |
 | PUT/POST | /settings/secrets | secrets.go — set a global secret `{key, value}`; auto-restarts every non-paused/non-removed/non-external workspace that does not shadow the key with a workspace-level override |
 | DELETE | /settings/secrets/:key | secrets.go — delete a global secret; same auto-restart fan-out as PUT/POST |
-| POST | /admin/workspaces/:id/tokens | admin_workspace_tokens.go — mint a real workspace bearer token; requires `AdminAuth`; plaintext is returned once |
+| GET | /admin/workspaces/:id/test-token | admin_test_token.go — mint a fresh bearer token for E2E scripts; returns 404 unless `MOLECULE_ENV != production` or `MOLECULE_ENABLE_TEST_TOKENS=1` |
 | GET/POST/DELETE | /admin/secrets[/:key] | secrets.go — legacy aliases for /settings/secrets |
 | WS | /workspaces/:id/terminal | terminal.go |
 | POST/GET | /workspaces/:id/approvals | approvals.go |
@@ -6,8 +6,6 @@ Molecule AI's memory model is built around one principle:

 That is the purpose of **HMA: Hierarchical Memory Architecture**.

-The organizational boundary is enforced **physically**, not at the application layer: each org runs as its own tenant on its own EC2, with its own memory plugin sidecar and its own Postgres. Memory writes are loopback-only — never cross-tenant. See [`workspace-placement.md`](workspace-placement.md) for the architecture contract that makes HMA tenant-isolated by construction.
-
 ## The Three Scopes

 | Scope | Meaning | Intended use |
@@ -49,26 +47,18 @@ It is useful for structured per-workspace state and optional TTL entries. It is

 `GET /workspaces/:id/session-search` provides a thin recall surface over recent activity rows and memory rows. It is for “what just happened in this workspace?” rather than long-term semantic storage.

-### 4. Memory v2 plugin (`memory_records` / `memory_namespaces`)
+### 4. Awareness-backed persistence

-This is the production-direction backend, behind the RFC #2728 HTTP
-contract. The plugin runs as a sidecar on each tenant EC2 (auto-spawned
-by `entrypoint-tenant.sh` when `MEMORY_PLUGIN_URL` is set), owns its
-own tables under the `memory_plugin` schema, and serves:
+When the runtime receives:

- `POST /workspaces/:id/v2/memories` (canvas `MemoryInspectorPanel`)
- `GET /workspaces/:id/v2/memories`
- `DELETE /workspaces/:id/v2/memories/:id`
- runtime tools `commit_memory_v2`, `search_memory`, `commit_summary`,
-  `forget_memory`
- legacy MCP tool names `commit_memory` / `recall_memory` via the
-  scope→namespace shim in `mcp_tools_memory_legacy_shim.go`
+```bash
+AWARENESS_URL=...
+AWARENESS_NAMESPACE=workspace:<id>
+```

-Capability negotiation (FTS, embedding, TTL, pin, propagation) is
-declared by the plugin via `GET /v1/health`; workspace-server adapts
-the tool surface to what the plugin actually supports. See
-[`memory-plugin-v1.yaml`](../api-protocol/memory-plugin-v1.yaml) for
-the full wire contract.
+the same memory tools keep the same interface, but durable memory writes/reads are routed through the workspace's awareness namespace.
+
+This is the current production direction of the memory boundary: stable tool surface, stronger backend isolation.

 ## Access Model

@@ -131,7 +121,7 @@ If you need:
 - **org-wide guidance**: use `GLOBAL`
 - **simple UI-visible structured state**: use `workspace_memory`
 - **recent decision/task recall**: use `session-search`
- **semantic / FTS search across memories**: use the v2 plugin endpoints (`/v2/memories?q=…`); they go through the plugin's pgvector + tsvector indexes when the plugin declares the capability
+- **stronger durable isolation**: enable awareness namespaces

 ## Related Docs

@@ -84,8 +84,6 @@ Six runtime adapters ship production-ready on `main`: LangGraph, DeepAgents, Cla

 ## 3. System Architecture

-> **Workspace placement contract:** every Molecule org runs as a fully isolated tenant on its own EC2, with workspace-server, memory plugin, Postgres, and Redis all co-located. The platform (controlplane on Railway) handles provisioning, billing, and DNS only — it never holds tenant data. See [`workspace-placement.md`](workspace-placement.md) for the formal RFC.
-
 ### System Boundary Diagram

 ```
@@ -428,10 +426,10 @@ submitted → working → completed

 | Surface | Storage | Endpoint | Purpose |
 |---------|---------|----------|---------|
-| **Memory v2 plugin (SSOT)** | `memory_plugin.memory_records` table via RFC #2728 HTTP plugin | `POST /workspaces/:id/v2/memories`, MCP tools `commit_memory` / `commit_memory_v2` / `commit_summary` | Production memory backend — agent reads/writes route through here exclusively |
-| **Key/value workspace memory** | `workspace_memory` table | `POST /workspaces/:id/memory` | Simple structured state, UI-visible, optional TTL — separate from agent memory |
-| **Activity recall** | `activity_logs` + `agent_memories` (legacy read-only) | `GET /workspaces/:id/session-search` | "What just happened?" contextual recall |
-| **Legacy `agent_memories`** | `agent_memories` table | `POST /workspaces/:id/memories` (REST) | Frozen post-A1 — kept only for the REST canvas-side path; the workspace-create `seedInitialMemories` writer routes through the v2 plugin once #1755 (PR #1759) lands. Scheduled for drop in Phase A3 (#1733). |
+| **Scoped agent memory** | `agent_memories` table | `POST /workspaces/:id/memories` | HMA-backed distributed memory with scope enforcement |
+| **Key/value workspace memory** | `workspace_memory` table | `POST /workspaces/:id/memory` | Simple structured state, UI-visible, optional TTL |
+| **Activity recall** | `activity_logs` + `agent_memories` | `GET /workspaces/:id/session-search` | "What just happened?" contextual recall |
+| **Awareness-backed** | External service | Same tool interface | When `AWARENESS_URL` + `AWARENESS_NAMESPACE` configured |

 ### Memory → Skill Compounding Flywheel

@@ -513,7 +511,7 @@ description: ""
 version: "1.0.0"
 tier: 2                                    # 1=sandboxed, 2=standard, 3=privileged, 4=full-host
 model: "anthropic:claude-sonnet-4-6"       # provider:model syntax
-runtime: "claude-code"                     # claude-code | codex | hermes | openclaw
+runtime: "langgraph"                       # langgraph | deepagents | claude-code | crewai | autogen | openclaw
 runtime_config:                            # Runtime-specific settings
  command: "claude"                        # For CLI runtimes
  args: []
@@ -567,13 +565,15 @@ compliance:
  max_task_duration_seconds: 300
 ```

-### Four Runtime Adapters
+### Six Runtime Adapters

 | Adapter | Core Strength | Image Tag |
 |---------|--------------|-----------|
+| **LangGraph** | Graph-based state machine, tool use, streaming | `workspace-template:langgraph` |
+| **DeepAgents** | Deep planning, multi-step task decomposition | `workspace-template:deepagents` |
 | **Claude Code** | Native coding workflows, CLI continuity, OAuth auth | `workspace-template:claude-code` |
-| **Codex** | OpenAI Codex coding workflows | `workspace-template:codex` |
-| **Hermes** | Hermes agent runtime | `workspace-template:hermes` |
+| **CrewAI** | Role-based crews, structured task orchestration | `workspace-template:crewai` |
+| **AutoGen** | Multi-agent conversations, explicit strategies | `workspace-template:autogen` |
 | **OpenClaw** | CLI-native runtime, own session model | `workspace-template:openclaw` |

 **Branch-level WIP**: NemoClaw (NVIDIA T4 + Docker socket) on `feat/nemoclaw-t4-docker`.
@@ -740,6 +740,7 @@ requires:
 | `hitl.py` | Multi-channel HITL (dashboard, Slack, email) | hitl.bypass_roles |
 | `sandbox.py` | Code execution (subprocess or Docker backend) | sandbox access |
 | `telemetry.py` | OpenTelemetry span creation and tracing | trace emission |
+| `awareness_client.py` | Awareness namespace memory wrapper | memory scope |
 | `security_scan.py` | CVE and security scanning (pip-audit/Snyk) | security audit |
 | `temporal_workflow.py` | Temporal.io workflow integration | workflow engine |
 | `a2a_tools.py` | A2A delegation helpers and route resolution | delegate/receive |
@@ -748,7 +749,8 @@ requires:

 | Server | Purpose |
 |--------|---------|
-| `molecule` | 20+ platform management tools (workspace CRUD, chat, memory, teams, secrets, files, approvals) — includes `commit_memory` / `commit_memory_v2` / `search_memory` routed through the v2 plugin |
+| `molecule` | 20+ platform management tools (workspace CRUD, chat, memory, teams, secrets, files, approvals) |
+| `awareness-memory` | Persistent cross-session memory via Awareness SDK |

 ---

@@ -907,7 +909,7 @@ Postgres + Redis + Langfuse only (for local development without containerized wo
 | `CORS_ORIGINS` | `http://localhost:3000,...` | CORS whitelist |
 | `RATE_LIMIT` | `600` | Requests per minute |
 | `WORKSPACE_DIR` | Optional | Shared workspace volume |
-| `MEMORY_PLUGIN_URL` | Unset by default | v2 memory plugin sidecar address. Typically set externally — CP user-data injects `http://localhost:9100` on tenant EC2 boot, which `entrypoint-tenant.sh` reads as the signal to spawn the bundled `memory-plugin` sidecar on the matching loopback port. When unset, today (pre-#1747) the legacy `agent_memories` SQL path is used as silent fallback; after #1747 (RFC #1733 Phase A1) lands, memory MCP tools return a "plugin not configured" error instead. |
+| `AWARENESS_URL` | Optional | Awareness service URL |

 ### Canvas (Next.js)

@@ -925,6 +927,8 @@ Postgres + Redis + Langfuse only (for local development without containerized wo
 | `WORKSPACE_CONFIG_PATH` | `/configs` | Config directory mount |
 | `PLATFORM_URL` | `http://platform:8080` | Platform connection |
 | `PARENT_ID` | Empty | Parent workspace ID (set if nested) |
+| `AWARENESS_URL` | Optional | Awareness service |
+| `AWARENESS_NAMESPACE` | Optional | Scoped namespace for awareness memory |
 | `LANGFUSE_HOST` | `http://langfuse-web:3000` | Langfuse endpoint |
 | `LANGFUSE_PUBLIC_KEY` | Optional | Langfuse auth |
 | `LANGFUSE_SECRET_KEY` | Optional | Langfuse auth |
@@ -1087,6 +1091,20 @@ Every Tier 1 launch (Open Interpreter, CrewAI) had all four elements.
 }
 ```

+### Awareness MCP Server
+
+For persistent cross-session memory:
+
+```json
+{
+  "awareness-memory": {
+    "type": "stdio",
+    "command": "npx",
+    "args": ["-y", "@awareness-sdk/local", "mcp"]
+  }
+}
+```
+
 ---

 ## 29. Summary Statistics
@@ -44,7 +44,7 @@ All three call `onWorkspaceOffline`, which broadcasts `WORKSPACE_OFFLINE` and ca

 ### Template Resolution (Workspace Create)

-Runtime detection happens **before** the DB insert: if `payload.Runtime` is empty and a template is specified, the handler reads `runtime:` from `configsDir/template/config.yaml` first. If still empty, it defaults to `"claude-code"`. This ensures the correct runtime is persisted in the DB and used for container image selection.
+Runtime detection happens **before** the DB insert: if `payload.Runtime` is empty and a template is specified, the handler reads `runtime:` from `configsDir/template/config.yaml` first. If still empty, it defaults to `"langgraph"`. This ensures the correct runtime (e.g. `claude-code`) is persisted in the DB and used for container image selection.

 When the requested template does not exist, the Create handler falls back in order:

@@ -1,194 +0,0 @@
-# Workspace placement — org-per-EC2 architecture
-
-Status: Accepted (implicit since 2026-05; formalized 2026-05-24)
-Owners: hongming (CTO), cui (CEO)
-Tracking: #1793
-
-This RFC formalizes the architecture decision that has been implicit in the system since the post-suspension rebuild: **each Molecule AI org is one isolated tenant on its own EC2 instance**, with every functional surface (workspace-server, memory plugin, Postgres, Redis, canvas) co-located on that instance. The platform's role is provisioning, billing, and the cross-tenant control plane — never the data path.
-
-The implementation already follows this pattern in every direction we look (provisioner, memory v2 cutover, tenant entrypoint, controlplane user-data, even the OSS deploy story). Writing it down so it stays that way.
-
-## TL;DR
-
-```
-                ┌──────────────────────────────────┐
-                │  Platform (controlplane)         │
-                │  Railway-hosted                  │
-                │  api.moleculesai.app             │
-                │                                  │
-                │  - org provisioning              │
-                │  - billing + Stripe integration  │
-                │  - DNS + tunnel orchestration    │
-                │  - auth / org-token issuance     │
-                │  - fleet redeploy orchestration  │
-                │                                  │
-                │  NEVER holds tenant data         │
-                └──────────────────────────────────┘
-                         │                      │
-              provision  │                      │  provision
-              + billing  │                      │  + billing
-                         ▼                      ▼
-       ┌─────────────────────────┐    ┌─────────────────────────┐
-       │  Tenant: agents-team    │    │  Tenant: <other-org>    │
-       │  Own EC2 (us-east-2)    │    │  Own EC2 (us-east-2)    │
-       │  agents-team.molecule.. │    │  <slug>.moleculesai.app │
-       │                         │    │                         │
-       │  ┌───────────────────┐  │    │  ┌───────────────────┐  │
-       │  │ molecule-tenant   │  │    │  │ molecule-tenant   │  │
-       │  │ (workspace-server │  │    │  │ (workspace-server │  │
-       │  │  + canvas + go)   │  │    │  │  + canvas + go)   │  │
-       │  └───────────────────┘  │    │  └───────────────────┘  │
-       │  ┌───────────────────┐  │    │  ┌───────────────────┐  │
-       │  │ memory-plugin     │  │    │  │ memory-plugin     │  │
-       │  │ (loopback :9100)  │  │    │  │ (loopback :9100)  │  │
-       │  └───────────────────┘  │    │  └───────────────────┘  │
-       │  ┌───────────────────┐  │    │  ┌───────────────────┐  │
-       │  │ postgres pgvector │  │    │  │ postgres pgvector │  │
-       │  │ (172.17.0.1:5432) │  │    │  │ (172.17.0.1:5432) │  │
-       │  └───────────────────┘  │    │  └───────────────────┘  │
-       │  ┌───────────────────┐  │    │  ┌───────────────────┐  │
-       │  │ redis             │  │    │  │ redis             │  │
-       │  └───────────────────┘  │    │  └───────────────────┘  │
-       │  ┌───────────────────┐  │    │  ┌───────────────────┐  │
-       │  │ workspace runtime │  │    │  │ workspace runtime │  │
-       │  │ containers (ws-*) │  │    │  │ containers (ws-*) │  │
-       │  └───────────────────┘  │    │  └───────────────────┘  │
-       └─────────────────────────┘    └─────────────────────────┘
-```
-
-Every tenant is a self-contained molecule-core instance. The platform is a thin coordinator above them.
-
-## What crosses the platform/tenant boundary
-
-What the platform sends down to the tenant:
-
- Initial EC2 provisioning (user-data script via SSM) — see `molecule-controlplane/internal/provisioner/ec2.go`
- Per-tenant secrets (DB password, `SECRETS_ENCRYPTION_KEY`, `MOLECULE_CP_SHARED_SECRET`) injected as env at boot
- Image redeploys via `POST /cp/admin/tenants/:slug/redeploy` → SSM → `docker pull && docker stop && docker run`
- DNS records (Cloudflare) and tunnel registration (cloudflared)
- Billing-state changes (subscription status, plan upgrades)
-
-What the tenant sends up to the platform:
-
- Boot-stage telemetry (`report_stage` calls during EC2 user-data execution)
- LLM usage events (for billing aggregation; documented in `controlplane/migrations/037_llm_usage_billing.up.sql`)
- Workspace lifecycle events for cross-tenant analytics — read-only, no remote control implied
-
-What does NOT cross the boundary:
-
- Memory contents (HMA scopes, agent_memories before A3, memory_plugin records after)
- Workspace state, files, canvas layouts
- Workspace runtime container state
- Per-org user authentication state (tenant issues its own session tokens via `wsauth`)
-
-If a feature design wants to put any of those on the platform side, that's a violation of this RFC and needs explicit justification.
-
-## SSOT rationale
-
-The single-source-of-truth boundary is **the tenant EC2**.
-
-This decision was the implicit basis for the memory v1→v2 migration that ran 2026-05-24 (issues #1747 → #1791 → #1792). The v2 memory plugin runs as a sidecar on each tenant EC2, sharing the tenant's Postgres under a dedicated `memory_plugin` schema. There is no platform-side memory aggregation, no central index, no cross-tenant memory federation. Memory writes are loopback-only (workspace-server → memory-plugin on `127.0.0.1:9100`).
-
-Why this is correct:
-
-1. **Organizational isolation is the product.** A tenant's memory, workspaces, secrets, and conversation history must not be readable by another org, ever. The simplest enforcement is physical: different EC2, different DB, different network. Application-level multi-tenancy adds a class of cross-tenant data leak bugs that can't happen here.
-
-2. **The platform must remain horizontally scalable independent of tenant data volume.** If memory aggregation lived on the platform, billing/provisioning/auth would scale with the volume of memory across all tenants. With per-tenant storage, the platform's scaling envelope depends only on the number of orgs.
-
-3. **OSS-deployability requires it.** molecule-core is open-source; anyone can deploy it. If functional state lived on a centralized platform, OSS deployers would either have to run their own platform (high barrier) or call ours (privacy concern + scale concern). Per-tenant SSOT means the OSS molecule-core instance is functionally complete — it just talks to a platform for billing.
-
-## OSS-deployment shape
-
-A workspace inside any tenant reaches its parent tenant by injecting two env vars at container start:
-
- `MOLECULE_ORG_ID` — the UUID of the org this workspace belongs to
- `MOLECULE_PLATFORM_URL` — the tenant's HTTPS URL (e.g. `https://agents-team.moleculesai.app`)
-
-These are baked into the workspace runtime's docker run by the workspace-server when it provisions a workspace. The workspace's agent runtime uses them to:
-
- Register itself in the tenant's `workspaces` table
- Send heartbeats (Redis TTL key on the tenant)
- Subscribe to A2A messages via the tenant's WebSocket hub
- Commit memories via the tenant's MCP bridge or HTTP `/memories` endpoints
-
-An OSS deployer running their own molecule-core instance gets the same shape: their workspaces inject the deployer's tenant URL and org ID. The agent runtime is **agnostic** to whether it's talking to our hosted platform or a self-hosted one.
-
-The only thing tying a tenant to **our** platform is the billing/auth path:
-
- `MOLECULE_CP_URL` env on the tenant container points at `api.moleculesai.app`
- `MOLECULE_CP_SHARED_SECRET` env authenticates the tenant→platform direction
- LLM usage events POST to `cp_url/cp/llm-usage-events` for billing aggregation
-
-An OSS deployer can leave `MOLECULE_CP_URL` unset (or point at their own platform). The workspace-server's `wiring.go` and `cp_provisioner.go` already handle the absent-CP case gracefully — the tenant is fully functional without it.
-
-## Scaling envelope
-
-Per-tenant resource shape (current):
-
-| Layer | Sizing |
-|---|---|
-| EC2 | t3.medium (2 vCPU, 4 GiB) for default-tier orgs |
-| Postgres | Single container, pgvector pre-installed, ~1-10 GiB per org expected |
-| Memory plugin | Loopback only, ~50 MB resident, scales with memory record count |
-| Workspace runtime containers (ws-\*) | One per workspace; sized by template tier |
-
-The platform's scaling envelope:
-
-| Layer | Sizing |
-|---|---|
-| controlplane | Single Railway service, scales horizontally |
-| Postgres | One Railway-hosted Postgres for billing + org registry + auth tokens |
-| DNS | Cloudflare zone with one CNAME per tenant |
-| Tunnels | One Cloudflare tunnel per tenant |
-
-Order-of-magnitude:
-
- 100 orgs: trivial (100 EC2s, controlplane unchanged)
- 10K orgs: needs an EC2 placement strategy (region pinning, dedicated-tier hosts), but the platform is still a single service
- 1M orgs: this design starts to strain — Cloudflare tunnel-per-tenant becomes expensive, EC2-per-tenant becomes resource-wasteful, and we'd want a denser tenant-on-shared-infra mode
-
-The current architecture is sized for the 100–10K range. The 1M-org variant is explicitly out of scope for this RFC.
-
-## Decision points for new feature design
-
-When proposing a new feature, the design must answer "where does the data live?" Pick one:
-
-1. **On the tenant.** Default choice for anything functional. Tenant DB, tenant memory plugin, tenant filesystem. The feature ships in `molecule-core` and is deployed via the tenant image.
-
-2. **On the platform.** ONLY for billing, cross-org analytics (anonymized), org registry, auth tokens, DNS/tunnel state. The feature ships in `molecule-controlplane`.
-
-3. **Both, with one as SSOT.** Rare. The tenant is the SSOT; the platform may cache for cross-tenant queries but must be willing to re-read from the tenant on miss. Document the cache invalidation contract.
-
-When in doubt, default to #1. If you find yourself wanting to put HMA memory, workspace state, or session history on the platform, stop — you're re-introducing the SSOT violation the v1→v2 memory migration was designed to remove.
-
-## Migration path for non-conforming code
-
-The implementation already conforms. There is no migration backlog as of 2026-05-24:
-
- Memory: v1→v2 migration complete (#1747 → #1791 → #1792). v2 plugin per-tenant is SSOT.
- Workspace state: always per-tenant (the `workspaces` table lives in the tenant Postgres).
- Activity logs: per-tenant `activity_logs` table.
- Files: per-tenant (Docker volumes attached to ws-\* containers).
- Secrets: per-tenant (`workspace_secrets` + `global_secrets` tables in tenant DB).
- LLM usage events: tenant emits, platform aggregates for billing — correct shape.
-
-If a future PR proposes platform-side aggregation of something functional, link this RFC in the review.
-
-## What this RFC does NOT cover
-
-Out of scope for this document; tracked separately if needed:
-
- **Multi-region tenant placement** — current design is single-region (us-east-2). Multi-region needs its own RFC because it changes the EC2 placement contract.
- **BYO-compute / customer-managed VPC** — adjacent design; the org-per-EC2 boundary holds but the EC2 ownership shifts to the customer.
- **Workspace runtime selection** — separately documented in `docs/architecture/workspace-tiers.md`.
- **Tenant image upgrade strategy** — separately documented in `docs/architecture/tenant-image-upgrades.md`.
- **OSS billing alternatives** — how OSS deployers handle billing without our controlplane is a separate go-to-market decision.
-
-## References
-
- `docs/architecture/memory.md` — HMA scopes + v2 plugin
- `docs/architecture/saas-prod-migration-2026-04-19.md` — provisioning pipeline reference
- `docs/architecture/molecule-technical-doc.md` §3 (System Architecture) — top-level picture
- `molecule-controlplane/internal/provisioner/ec2.go` — the canonical user-data + docker run for tenants
- `workspace-server/entrypoint-tenant.sh` — the canonical tenant boot script
- Memory system migration: #1747 (kill v1 fallback), #1791 (Phase A2 backfill), #1792 (Phase A3 drop table)
@@ -109,9 +109,8 @@ curl -X POST http://localhost:8080/registry/register \
 # Response: {"auth_token": "...", ...}
 ```

-Tenant admins can mint a real workspace token through the production-safe admin route:
+For development, the test-token endpoint is also available (disabled in production):
 ```bash
-curl -X POST http://localhost:8080/admin/workspaces/<id>/tokens \
-  -H "Authorization: Bearer <ADMIN_TOKEN>"
+curl http://localhost:8080/admin/workspaces/<id>/test-token
 # Response: {"auth_token": "...", "workspace_id": "..."}
 ```
@@ -24,10 +24,10 @@ features:
    details: Build agent organizations as nested workspaces on a live React Flow canvas with drag-to-nest hierarchy, template deployment, bundles, and real-time updates.
    icon: "🗺️"
  - title: Runtime Compatibility
-    details: Current main ships adapters for Claude Code, Codex, Hermes, and OpenClaw under one workspace contract and A2A surface.
+    details: Current main ships adapters for LangGraph, DeepAgents, Claude Code, CrewAI, AutoGen, and OpenClaw under one workspace contract and A2A surface.
    icon: "⚙️"
  - title: Hierarchical Memory
-    details: HMA-style LOCAL, TEAM, and GLOBAL scopes backed by the v2 memory plugin (per-tenant pgvector sidecar with FTS + semantic recall).
+    details: HMA-style LOCAL, TEAM, and GLOBAL scopes plus workspace-scoped awareness namespaces when awareness is configured.
    icon: "🧠"
  - title: Skill Evolution
    details: Local SKILL.md packages, tool loading, plugin-mounted shared capabilities, hot reload, and a documented memory-to-skill promotion path.
@@ -49,13 +49,13 @@ features:
 |---|---|
 | **Canvas** | Empty-state deployment, onboarding guide, 10-tab side panel, template palette, bundle import/export, drag-to-nest teams, search, activity and trace views |
 | **Platform** | Workspace CRUD, registry, A2A proxy, team expansion, approvals, secrets, global secrets, memory APIs, files API, terminal, viewport persistence, WebSocket fanout |
-| **Runtime** | One workspace image with four shipping adapters on `main`: Claude Code, Codex, Hermes, OpenClaw |
-| **Memory** | v2 plugin (pgvector + FTS) serving scoped agent memories under per-workspace namespaces; key/value workspace memory; session-search recall |
+| **Runtime** | One workspace image with six shipping adapters on `main`: LangGraph, DeepAgents, Claude Code, CrewAI, AutoGen, OpenClaw |
+| **Memory** | Scoped agent memories, key/value workspace memory, session-search recall, awareness namespace injection |
 | **Skills** | Local skill packages, plugin-mounted shared skills/rules, audit/install/publish CLI helpers, hot reload |

 ## Compatibility Note

-`main` currently ships four runtime adapters: Claude Code, Codex, Hermes, and OpenClaw. `NemoClaw` appears in branch-level work (`feat/nemoclaw-t4-docker`) and is not documented here as merged `main` functionality.
+`main` currently ships six runtime adapters. `NemoClaw` appears in branch-level work (`feat/nemoclaw-t4-docker`) and is not documented here as merged `main` functionality.

 ## Recommended Reading

@@ -19,8 +19,8 @@ import (
    "context"
    "testing"

-    mclient "git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/memory/client"
-    "git.moleculesai.app/molecule-ai/molecule-core/workspace-server/internal/memory/contract"
+    mclient "github.com/Molecule-AI/molecule-monorepo/platform/internal/memory/client"
+    "github.com/Molecule-AI/molecule-monorepo/platform/internal/memory/contract"
 )

 func TestMyPlugin_FullRoundTrip(t *testing.T) {
@@ -238,7 +238,7 @@ No inbound firewall rules needed — the agent initiates the outbound WebSocket
 ## What To Try Next

 - **Expand to a team:** right-click a workspace and choose `Expand to Team`.
- **Switch runtime:** use `Config -> Runtime` to move between Claude Code, Codex, Hermes, and OpenClaw.
+- **Switch runtime:** use `Config -> Runtime` to move between LangGraph, DeepAgents, Claude Code, CrewAI, AutoGen, and OpenClaw.
 - **Inspect operations:** check `Activity`, `Traces`, `Events`, and `Terminal`.
 - **Use global keys:** configure one provider once in `Secrets & API Keys -> Global`.
 - **Import a template:** use the template palette or `POST /templates/import`.
@@ -268,7 +268,7 @@ Browser  -->  Canvas (Next.js :3000)
                                |
                                v
                       Provisioned workspaces
-                     (Claude Code / Codex / Hermes / OpenClaw)
+                     (LangGraph / Claude Code / CrewAI / AutoGen / etc.)
 ```

 For the full system model, see [Architecture](./architecture/architecture.md).
--- a/Show More
+++ b/Show More